eJPT Password Attacks and Cracking 3

Question 1

What purpose does salting a password hash serve?

Accepted Answer

It adds a random value to the password before hashing, defeating precomputed rainbow tables

Answer

A salt is a random value appended or prepended to a password before hashing, ensuring identical passwords produce different hashes and defeating rainbow table attacks.

Question 2

Which Hydra flag specifies the target username during a brute-force attack?

Accepted Answer

-l

Answer

The -l flag in Hydra specifies a single username to target, while -L specifies a file containing multiple usernames.

Question 3

What type of attack involves testing a few common passwords against many accounts to avoid account lockouts?

Accepted Answer

Password spraying

Answer

Password spraying tests a small set of common passwords (like 'Password1!') across many accounts, staying below lockout thresholds by limiting attempts per account.

Question 4

Which John the Ripper flag displays the cracked passwords found so far?

Accepted Answer

john --show

Answer

Running 'john --show <hashfile>' displays all previously cracked passwords stored in John's pot file for the given hash file.

Question 5

What is credential stuffing?

Accepted Answer

Using leaked username/password pairs from one breach to try logging into other services

Answer

Credential stuffing exploits password reuse by testing username/password pairs leaked from one service against other platforms.

eLearnSecurity Junior Penetration Tester eJPT Practice Practice Test

eLearnSecurity Junior Penetration Tester eJPT Practice Practice Test

eJPT Password Attacks and Cracking 3