Question

During an internal engagement, you have permission to map a target's 10.20.30.0/24 subnet. You want to passively correlate live IP addresses with meaningful hostnames without sending traffic to each host directly. Which technique best supports building this network map by leveraging the organization's own DNS infrastructure?

Accepted Answer

Run reverse DNS (PTR) lookups against the organization's DNS server for each IP in the range

Answer

Perform an Nmap SYN scan (-sS) across all 254 hosts to identify open ports

Answer

Send ICMP echo requests to the broadcast address to enumerate responding hosts

Answer

Query crt.sh certificate transparency logs for the internal subnet