eJPT Password Attacks and Cracking 2 — Questions and Answers
Question 1: Which Hashcat attack mode uses a wordlist combined with rules to generate password candidates?
- Brute-force mode (-a 3)
- Combination mode (-a 1)
- Wordlist mode with rules (-a 0 -r) (Correct answer)
- Mask attack mode (-a 6)
Correct answer: Wordlist mode with rules (-a 0 -r)
Hashcat's straight/wordlist mode (-a 0) paired with a rules file (-r) applies transformations like capitalization and substitutions to each word in the list.
Question 2: What is the primary difference between a dictionary attack and a brute-force attack?
- Dictionary attacks only target Windows hashes
- Dictionary attacks use a predefined list of words while brute-force tries all character combinations (Correct answer)
- Brute-force attacks are faster than dictionary attacks
- Dictionary attacks require GPU acceleration
Correct answer: Dictionary attacks use a predefined list of words while brute-force tries all character combinations
A dictionary attack tests passwords from a predefined wordlist, while brute-force exhaustively tries every possible combination of characters.
Question 3: Which tool is specifically designed for online password attacks against services like SSH and FTP?
- John the Ripper
- Hashcat
- Hydra (Correct answer)
- Mimikatz
Correct answer: Hydra
Hydra is a parallelized network login cracker that supports online brute-force attacks against protocols like SSH, FTP, HTTP, and many others.
Question 4: What does the rockyou.txt wordlist contain?
- SHA-256 hashes from the RockYou breach
- Plaintext passwords leaked from the 2009 RockYou data breach (Correct answer)
- MD5 hashes commonly found in Linux systems
- Randomly generated passwords for penetration testing
Correct answer: Plaintext passwords leaked from the 2009 RockYou data breach
rockyou.txt contains approximately 14 million plaintext passwords leaked from the 2009 RockYou social game company data breach.
Question 5: In a pass-the-hash attack, what is actually passed to authenticate?
- The plaintext password
- The NTLM hash of the password (Correct answer)
- A Kerberos ticket
- A base64-encoded password
Correct answer: The NTLM hash of the password
Pass-the-hash attacks use the captured NTLM hash directly to authenticate to Windows services without needing to crack it to plaintext.
Question 6: Which Linux file contains hashed user passwords in modern systems?
- /etc/passwd
- /etc/shadow (Correct answer)
- /etc/group
- /etc/security
Correct answer: /etc/shadow
Modern Linux systems store hashed passwords in /etc/shadow, which is only readable by root, unlike /etc/passwd which is world-readable.
Question 7: What is a rainbow table attack?
- An attack using colorful ASCII art to confuse IDS systems
- A precomputed table of hash-to-plaintext mappings used to reverse hashes quickly (Correct answer)
- A network attack targeting multicast traffic
- An attack exploiting SSL/TLS rainbow connections
Correct answer: A precomputed table of hash-to-plaintext mappings used to reverse hashes quickly
Rainbow tables are precomputed lookup tables mapping hash values to their original plaintexts, trading storage space for cracking speed.
eJPT Password Attacks and Cracking 2
Which Hashcat attack mode uses a wordlist combined with rules to generate password candidates?