Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
Ethical hacking · Question Set
Recon & OSINT interview questions for placements and exams.
Questions
15
Included in this set
Subject
Ethical hacking
Explore more sets
Difficulty
Mixed
Level of this set
Go through each question and its explanation. Use this set as a focused practice pack for Ethical hacking.
Pick passive to avoid touching the target and to move fast using third-party sources. Choose active when you have approval to probe and want deeper coverage with brute force, alterations, and DNS resolution checks. Many teams start passive, then confirm with limited active steps.
amass enum -passive -d example.com amass enum -brute -active -d example.com
For complete preparation, combine this set with full subject-wise practice for Ethical hacking. You can also explore other subjects and sets from the links below.
Passive methods use third-party sources like search engines, C T logs, and public datasets. Active methods send probes to the target such as pings, scans, or HTTP requests.
Passive: site:example.com filetype:pdf Active: nmap -sV example.com
C T logs, historical DNS, and search engines do not directly hit the target. Brute force and fuzzing are active as they send queries to target name servers or web servers.
amass enum -passive -d example.com
C T logs are public and show certificates issued for a domain. Hostnames on those certs often include new apps and subdomains.
curl 'https://crt.sh/?q=%25.example.com&output=json' | jq '.[].name_value'
The site operator limits to a domain. The filetype operator limits to a specific document format, such as P D F.
site:careers.example.com filetype:pdf "confidential"
The org filter restricts results by organization. ASN filters by autonomous system, city filters by location, product filters by software banners.
org:"Example Corp" port:443 http.title:"login"
M X records point to mail exchangers used for inbound email. TXT records also help for SPF and DMARC, but mail routing starts with M X.
dig MX example.com +short
F f u f can brute force virtual hosts by fuzzing the Host header or paths. Search engines are passive; graphs are visual analysis, not brute force.
ffuf -w subs.txt -u https://FUZZ.example.com -mc 200,301
Metadata can leak creator names, tool versions, timestamps, and geo tags that support pivoting and social engineering.
exiftool report.pdf exiftool image.jpg | grep GPS
Respect scope and consent. Avoid privacy harm by collecting only what is needed. Do not attempt login or bypass controls during passive work. Document sources and timestamps so results can be verified later.
Rules: scope_only; minimize_data; no_auth_attempts; timestamp_sources
Start passive: whois, DNS, subdomains from C T logs and search engines. Collect tech stack from headers and icons. Enumerate public endpoints and docs. Build an asset list and rank by exposure. Only then run safe, rate-limited active checks that were approved.
whois; dig ANY; subfinder -d target; curl -I; httpx -l hosts.txt -status -tech-detect
Collect naming patterns from public PDFs and social profiles. Check MX and SPF or DMARC TXT for mail providers. Do not brute force accounts. Use breach corpuses carefully and disclose only minimal evidence. Purpose is to inform risk, not to access mail.
dig TXT example.com | grep spf Pattern: first.last@example.com from public docs
Record source link, query or command used, timestamp, scope tag, and data hash if files were saved. Note environment like resolver or V P N exit. Add reasoning on why the item matters. This lets others reproduce and verify the same result later.
log.csv fields: time, source, query, scope_id, notes, sha256
Robots guidelines sometimes include sensitive or obsolete paths that hint at admin or backup areas. It is a hint, not an access control.
curl -s https://example.com/robots.txt
WHOIS and A S N data reveal ownership and address ranges. This helps map external attack surface in a lawful and structured way.
whois example.com whois AS13335