eJPT Password Attacks and Credential Testing 3

Question 1

Which protocol does Windows use for challenge-response authentication that can be captured and cracked offline using tools like Responder?

Accepted Answer

NTLMv2

Answer

Kerberos

Answer

LDAP

Answer

SMBv3

Question 2

What is a password spraying attack and why is it preferred over traditional brute force in some scenarios?

Accepted Answer

Trying one or a few common passwords against many accounts; preferred to avoid account lockouts

Answer

Trying many passwords against one account; preferred because it is faster

Answer

Spraying hashes across the network; preferred because it bypasses firewalls

Answer

Using rainbow tables across multiple targets; preferred due to lower storage requirements

Question 3

Which Hashcat rule file applies common password mutations like adding numbers and capitalizing letters?

Accepted Answer

best64.rule

Answer

toggle.rule

Answer

leet.rule

Answer

append.rule

Question 4

What is the purpose of using a mask attack (-a 3) in Hashcat?

Accepted Answer

To generate candidate passwords based on a defined character-set pattern

Answer

To hide the attacker's IP address during online attacks

Answer

To apply transformation rules to a wordlist

Answer

To combine two wordlists into candidate pairs

Question 5

Which command extracts the /etc/shadow file entries into a format John the Ripper can process when combined with /etc/passwd?

Accepted Answer

unshadow /etc/passwd /etc/shadow > combined.txt

Answer

shadow2john /etc/passwd /etc/shadow > combined.txt

Answer

combine /etc/shadow /etc/passwd > combined.txt

Answer

john --merge /etc/passwd /etc/shadow > combined.txt

Question 6

During a penetration test you capture an NTLMv2 hash with Responder. What is the next step to obtain plaintext credentials?

Accepted Answer

Use Hashcat with mode -m 5600 to crack the hash offline

Answer

Pass the hash directly to Mimikatz

Answer

Replay the hash using Metasploit's psexec module

Answer

Submit the hash to a rainbow table database for NTLMv1

Question 7

What is the main advantage of using Hashcat over John the Ripper for password cracking on a system with a modern GPU?

Accepted Answer

Hashcat natively leverages GPU acceleration for significantly faster cracking speeds

Answer

Hashcat supports more operating systems

Answer

Hashcat automatically generates wordlists without input files

Answer

Hashcat can perform online attacks without network access