While performing reconnaissance, a penetration tester attempts to identify publicly accessible ICS (Industrial Control Systems) and IoT (Internet of Things) systems. Which of the following tools is most effective for this task?
Correct Answer: B
Shodan is a search engine that specializes in finding internet-connected devices, including ICS, IoT, webcams, routers, and servers. Attackers and security professionals use Shodan to scan for publicly accessible systems that may be vulnerable.
* Option A (theHarvester) #: theHarvester is primarily used for OSINT (Open-Source Intelligence) gathering, such as email addresses, subdomains, and hostnames, but it does not specialize in ICS/IoT discovery.
* Option B (Shodan) #: Correct. Shodan scans the internet for connected devices and services, allowing penetration testers to find ICS/IoT systems that are exposed.
* Option C (Amass) #: Amass is used for subdomain enumeration and DNS reconnaissance, not for ICS or IoT discovery.
* Option D (Nmap) #: Nmap is a port scanner that can identify live hosts and open ports, but it does not search for publicly available systems on a large scale like Shodan.
# Reference: CompTIA PenTest+ PT0-003 Official Guide - OSINT and Reconnaissance