A city asks whether banner grabbing is hacking or enumeration. How should the tester classify it?
Select an answer to reveal the explanation.
Short Explanation
Reading the sign on the shop window is enumeration, not smashing the register. Banners and service replies often spill versions and sloppy configs. That intel shapes what you check next — it is not the whole break-in.
Full Explanation
Banner grabbing is enumeration: collecting service replies that can disclose versions and misconfigurations with security relevance for the city. It is not automatically full exploitation or a critical breach by itself. Banners are not entertainment text without attack-surface value. Banner grabbing does not require prior domain dominance to be permitted when recon is in scope. Exam caveat: some banners are misleading; use them as leads, not as sole proof of vulnerability. Operational check: capture banners for in-scope listeners, store them with host and timestamp, correlate with version research, and promote promising leads into manual validation while labeling the activity as enumeration in civic notes. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.