eJPT Password Attacks and Credential Testing 2 — Questions and Answers
Question 1: A rainbow table attack is effective because it trades which resource for speed in password cracking?
- Network bandwidth for CPU cycles
- Memory for computation time
- Disk space for reduced memory
- CPU time for storage space (Correct answer)
Correct answer: CPU time for storage space
Rainbow tables pre-compute and store hash-to-plaintext chains, trading disk storage space for dramatically reduced cracking computation time.
Question 2: Which technique adds a random value to a password before hashing to defend against rainbow table attacks?
- Pepper
- Salting (Correct answer)
- Stretching
- Padding
Correct answer: Salting
Salting appends or prepends a unique random value (salt) to each password before hashing, making pre-computed rainbow tables ineffective.
Question 3: When using Hashcat to crack an NTLM hash, which hash type (-m) value should be specified?
- -m 500
- -m 1800
- -m 1000 (Correct answer)
- -m 100
Correct answer: -m 1000
Hashcat uses -m 1000 for NTLM hashes, which are the Windows password hash format stored in the SAM database and NTDS.dit.
Question 4: Which tool can extract NTLM password hashes from a Windows SAM database?
- John the Ripper
- Mimikatz (Correct answer)
- Netcat
- Nmap
Correct answer: Mimikatz
Mimikatz is a post-exploitation tool capable of dumping NTLM hashes and plaintext credentials from Windows memory and the SAM database.
Question 5: What is a Pass-the-Hash (PtH) attack?
- Passing a hashed wordlist to Hashcat for cracking
- Using a captured NTLM hash to authenticate without knowing the plaintext password (Correct answer)
- Sending hashed traffic over an encrypted channel
- Converting a hash from one algorithm to another
Correct answer: Using a captured NTLM hash to authenticate without knowing the plaintext password
Pass-the-Hash exploits Windows authentication by using a captured NTLM hash directly for authentication, bypassing the need to crack it to plaintext.
Question 6: Which Medusa command targets FTP on host 10.10.10.5 with user 'ftp' and a password list?
- medusa -h 10.10.10.5 -u ftp -P passwords.txt -M ftp (Correct answer)
- medusa -t 10.10.10.5 -l ftp -w passwords.txt -s ftp
- medusa -host 10.10.10.5 -user ftp -pass passwords.txt -module ftp
- medusa -h 10.10.10.5 -U ftp -p passwords.txt -M ftp
Correct answer: medusa -h 10.10.10.5 -u ftp -P passwords.txt -M ftp
Medusa uses -h for host, -u for a single username, -P for a password file, and -M to specify the protocol module (ftp).
Question 7: What does the rockyou.txt wordlist contain and where is it typically found on Kali Linux?
- Common usernames; located at /etc/wordlists/rockyou.txt
- Passwords leaked from the RockYou breach; located at /usr/share/wordlists/rockyou.txt (Correct answer)
- SSL certificates; located at /var/lib/rockyou.txt
- MD5 hashes of common passwords; located at /opt/rockyou.txt
Correct answer: Passwords leaked from the RockYou breach; located at /usr/share/wordlists/rockyou.txt
rockyou.txt contains ~14 million passwords from the 2009 RockYou data breach and is the most commonly used password wordlist on Kali Linux at /usr/share/wordlists/rockyou.txt.
eJPT Password Attacks and Credential Testing 2
A rainbow table attack is effective because it trades which resource for speed in password cracking?