CoreQ Academy2.4 Given a scenario, use the appropriate tools for reconnaissance and enumeration.
Match the tool to the question you are trying to answer.
OSINT tools
- Wayback Machine
- Internet Archive snapshots of past website versions, revealing removed pages and files.
- Maltego
- Graph-based OSINT tool that links people, domains, emails and infrastructure.
- Recon-ng
- Modular command-line OSINT framework.
- Shodan
- Search engine for internet-connected devices and their banners.
- SpiderFoot
- Automated OSINT collection across many sources.
- WHOIS
- Domain registration and IP ownership records.
- nslookup/dig
- Command-line DNS query tools; dig gives more detail.
- Censys.io
- Search engine for hosts and certificates on the internet.
- Hunter.io
- Finds email addresses and formats used by an organisation.
- DNSdumpster
- Online DNS reconnaissance that maps subdomains and hosts.
- Amass
- OWASP tool for in-depth subdomain enumeration and attack surface mapping.
- theHarvester
- Gathers emails, names, subdomains and hosts from public sources.
- OSINTframework.com
- A categorised directory of OSINT tools and resources.
Network and wireless tools
- Nmap
- The standard network scanner for host discovery, port scanning, service and OS detection.
- Nmap Scripting Engine (NSE)
- Nmap scripts for deeper enumeration and vulnerability checks.
- WiGLE.net
- Crowdsourced database of wireless networks and their locations.
- InSSIDer
- Wi-Fi scanner showing networks, channels and signal strength.
- Wireshark/tcpdump
- Packet capture and analysis (GUI and command line).
- Aircrack-ng
- Wireless auditing suite for monitoring, capturing and testing Wi-Fi security.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 2.4 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.