eJPT Password Attacks and Credential Testing 1 — Questions and Answers
Question 1: Which Hydra command correctly performs a dictionary attack against an SSH service on port 22 using a wordlist file?
- hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.10 (Correct answer)
- hydra -u admin -w /usr/share/wordlists/rockyou.txt 192.168.1.10 ssh
- hydra -L admin -P /usr/share/wordlists/rockyou.txt 192.168.1.10:22
- hydra -l admin -W /usr/share/wordlists/rockyou.txt ssh 192.168.1.10
Correct answer: hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.10
Hydra uses -l for a single username, -P for a password file, and the format 'protocol://target' to specify the service and host.
Question 2: What type of password attack tries every possible character combination until the correct password is found?
- Dictionary attack
- Brute force attack (Correct answer)
- Credential stuffing
- Rainbow table attack
Correct answer: Brute force attack
A brute force attack systematically tries every possible combination of characters until it finds the correct password, making it exhaustive but slow.
Question 3: Which tool is commonly used on Linux to crack password hashes stored in the /etc/shadow file?
- Hydra
- Medusa
- John the Ripper (Correct answer)
- Netcat
Correct answer: John the Ripper
John the Ripper is an offline password cracker widely used to crack Unix/Linux password hashes extracted from /etc/shadow.
Question 4: What is the difference between an online and offline password attack?
- Online attacks use the internet; offline attacks use a local network
- Online attacks require an active connection to a service; offline attacks crack captured hashes locally (Correct answer)
- Online attacks use wordlists; offline attacks use brute force only
- Online attacks target web applications; offline attacks target operating systems
Correct answer: Online attacks require an active connection to a service; offline attacks crack captured hashes locally
Online attacks authenticate directly against a live service, while offline attacks crack password hashes captured from a database or file without interacting with the service.
Question 5: Which file on a Linux system stores hashed user passwords?
- /etc/passwd
- /etc/group
- /etc/shadow (Correct answer)
- /etc/security
Correct answer: /etc/shadow
Modern Linux systems store hashed passwords in /etc/shadow, which is only readable by root, rather than the world-readable /etc/passwd.
Question 6: What is credential stuffing?
- Padding plaintext credentials into a network packet
- Using username/password pairs leaked from one breach to attack other services (Correct answer)
- Filling a login form with random characters to cause an error
- Encrypting stolen credentials before exfiltration
Correct answer: Using username/password pairs leaked from one breach to attack other services
Credential stuffing exploits password reuse by taking credentials from known data breaches and trying them against other sites or services.
Question 7: Which Hashcat attack mode (-a flag) corresponds to a straight dictionary attack?
- -a 3
- -a 1
- -a 6
- -a 0 (Correct answer)
Correct answer: -a 0
Hashcat uses -a 0 for a straight (wordlist/dictionary) attack, where each line in the wordlist is tried as a candidate password.
eJPT Password Attacks and Credential Testing 1
Which Hydra command correctly performs a dictionary attack against an SSH service on port 22 using a wordlist file?