Skip to content
SudoSecurity

Sections

beginner · osint · 100 points · 0 working it

OSINT: Mapping a Target

Before any engagement you map the target passively. Identify the recon technique that fits each scenario.

  1. Public registration data

    A domain's ownership trail — registrar, dates, nameservers — lives in a public database query that takes seconds and touches nothing.

    Which lookup reveals domain registration details?

    Hint

    Who ___ the domain.

    Sign in to verify this checkpoint.

  2. Fingerprint the web server

    Response headers usually announce the server software outright. curl -I on the target shows Server: nginx — the software name is the checkpoint.

    Which web server is the target running?

    Hint

    The most common reverse proxy.

    Sign in to verify this checkpoint.

  3. Read the crawl rules

    Sites tell crawlers which paths to skip — and in doing so list their interesting directories. The filename is the checkpoint.

    Which well-known file discloses hidden paths?

    Hint

    Sits at the site root; starts with r.

    Sign in to verify this checkpoint.