During a black box penetration test, which tool is most helpful for gathering information about ownership, IP addresses, domain names, locations, and server types during recon?

During a black box penetration test, which tool is most helpful for gathering information about ownership, IP addresses, domain names, locations, and server types during recon?

• A. Nmap
• B. Traceroute
• C. Whois
• D. Shodan

Answer: (C)

When gathering information in the recon phase, you want to map who owns the domain and where its resources sit on the internet. Whois provides the registration records for domains and the IP address allocations, linking them to specific organizations and geographic locations. It reveals the registrant or organization, contact details, and the IP blocks assigned to that entity, helping you identify ownership and where the assets are hosted. Other tools serve different purposes—port and service discovery with Nmap, network path with Traceroute, or device and service details with Shodan—but they don’t directly give you authoritative ownership and registration data or the exact IP ownership mapping you get from Whois. So for learning who controls the domain, what IP ranges are in use, and where those assets are located during recon, Whois is the best fit.

When gathering information in the recon phase, you want to map who owns the domain and where its resources sit on the internet. Whois provides the registration records for domains and the IP address allocations, linking them to specific organizations and geographic locations. It reveals the registrant or organization, contact details, and the IP blocks assigned to that entity, helping you identify ownership and where the assets are hosted. Other tools serve different purposes—port and service discovery with Nmap, network path with Traceroute, or device and service details with Shodan—but they don’t directly give you authoritative ownership and registration data or the exact IP ownership mapping you get from Whois. So for learning who controls the domain, what IP ranges are in use, and where those assets are located during recon, Whois is the best fit.