eJPT Password Attacks and Credential Testing

Question 1

Which tool is commonly used for dictionary-based password attacks against SSH services?

Accepted Answer

Hydra

Answer

Hydra is a popular network login cracker that supports dictionary attacks against SSH and many other protocols.

Question 2

What is the key difference between a dictionary attack and a brute force attack?

Accepted Answer

Dictionary attacks try known words/passwords while brute force tries all possible combinations

Answer

Dictionary attacks test a predefined list of likely passwords, while brute force systematically tries every possible combination of characters.

Question 3

What is a rainbow table used for in password cracking?

Accepted Answer

To store precomputed hash-to-password mappings for faster cracking

Answer

Rainbow tables are precomputed tables of hash values that allow fast lookup to reverse cryptographic hash functions without recalculating them.

Question 4

What is credential stuffing?

Accepted Answer

Using previously breached username/password pairs against other services

Answer

Credential stuffing uses leaked credentials from one breach to attempt login on other services, exploiting the fact that users often reuse passwords.

Question 5

Which Hydra flag specifies a single username when performing a targeted attack?

Accepted Answer

-l

Answer

The -l flag in Hydra specifies a single login/username, while -L specifies a file containing multiple usernames.

eJPT Practice Test