eJPT Password Attacks and Credential Testing 3

Question 1

Which protocol does Windows use for challenge-response authentication that can be captured and cracked offline using tools like Responder?

Accepted Answer

NTLMv2

Answer

NTLMv2 challenge-response hashes can be captured with Responder when clients attempt to authenticate over the network and then cracked offline with Hashcat or John.

Question 2

What is a password spraying attack and why is it preferred over traditional brute force in some scenarios?

Accepted Answer

Trying one or a few common passwords against many accounts; preferred to avoid account lockouts

Answer

Password spraying tries a small set of common passwords against many accounts, avoiding repeated failures on any single account that would trigger lockout policies.

Question 3

Which Hashcat rule file applies common password mutations like adding numbers and capitalizing letters?

Accepted Answer

best64.rule

Answer

best64.rule contains 64 of the most effective password mutation rules (capitalization, number appending, substitutions) and ships with Hashcat.

Question 4

What is the purpose of using a mask attack (-a 3) in Hashcat?

Accepted Answer

To generate candidate passwords based on a defined character-set pattern

Answer

A mask attack defines a pattern (e.g., ?u?l?l?l?d?d) that specifies the character sets for each position, generating only candidates matching that structure instead of all possible strings.

Question 5

Which command extracts the /etc/shadow file entries into a format John the Ripper can process when combined with /etc/passwd?

Accepted Answer

unshadow /etc/passwd /etc/shadow > combined.txt

Answer

The 'unshadow' utility (bundled with John the Ripper) merges /etc/passwd and /etc/shadow into a single file that John can read and crack.

eJPT Practice Test

eJPT Practice Test

eJPT Password Attacks and Credential Testing 3