PT0-003: CompTIA PenTest+Demo

By CompTIA · Question Mode

QuestionQ204

Reconnaissance and Enumeration

A penetration tester has completed OSINT and needs to identify common subdomains for mydomain.com. Which of the following is the best command for the tester to use?

  • A nslookup mydomain.com >> /path/to/results.txt
  • B crunch 1 2 | xargs -n 1 -I 'X' nslookup X.mydomain.com
  • C dig @8.8.8.8 mydomain.com any >> /path/to/results.txt
  • D cat wordlist.txt | xargs -n 1 -I 'X' host X.mydomain.com
Explanation

A wordlist-based DNS enumeration command tests likely subdomain names by appending each wordlist entry to mydomain.com and resolving the resulting hostname. This efficiently identifies common names such as www, mail, or dev when their DNS records exist.

Community Discussion

No comments yet. Be the first to start the discussion!