Password Attacks and Cracking Flashcards

A penetration tester has obtained a list of password hashes from a compromised Windows machine. They want to recover the plaintext passwords as efficiently as possible by using a precomputed lookup table that maps hashes to passwords. Which type of attack is this?

Answer: Rainbow table attack

A rainbow table attack uses a precomputed table to reverse cryptographic hash functions, allowing an attacker to quickly find the plaintext password corresponding to a captured hash. [2, 3] This is more efficient than a brute-force attack, which tries every possible combination, or a dictionary attack, which is limited to a wordlist. [4] A pass-the-hash attack uses the hash itself to authenticate, without needing to crack it. [9]

During a penetration test, an attacker gains access to a user's NTLM hash. Instead of spending time cracking the hash to reveal the plaintext password, the attacker uses the hash directly to authenticate to other network resources and move laterally. What is this technique called?

Answer: Pass-the-hash (PtH)

A Pass-the-Hash (PtH) attack is an exploit where an attacker steals a hashed user credential and reuses it to authenticate and create new sessions on a network. [8, 9] The key characteristic is that the attacker does not need to crack the hash to find the original password. [10]

Which of the following password cracking tools is specifically designed to perform dictionary attacks, but can also be extended to perform brute-force and rainbow table attacks, making it a highly versatile offline password cracker?

Answer: John the Ripper

John the Ripper (JTR) is a popular and powerful password cracking tool primarily used for dictionary attacks. [19] It is highly versatile and supports multiple modes, including brute-force attacks, and can utilize rainbow tables. [25, 26] Metasploit is an exploitation framework, Wireshark is a packet analyzer, and Nmap is a network scanner; none are primarily password crackers.

A junior penetration tester is attempting to crack a password for a web application login. They decide to use an automated tool that systematically tries every possible combination of letters, numbers, and symbols. Which attack method are they using?

Answer: Brute-Force Attack

A brute-force attack is a method that involves systematically trying every possible combination of characters until the correct password is found. [1] This contrasts with a dictionary attack, which uses a list of common words, or password spraying, which tries a few common passwords against many accounts. [1, 29]

In a scenario where an attacker has a list of common passwords (e.g., 'password123', 'qwerty', '123456') and wants to see if any of these passwords work for a large number of different user accounts on a single system, which attack is being performed?

Answer: Password Spraying

Password spraying is a type of brute-force attack where an attacker tries a small number of common passwords against many different user accounts. [29] This technique avoids account lockouts that typically occur when many incorrect passwords are used for a single account.

A penetration tester is using a wordlist containing millions of previously breached passwords to try and gain access to an FTP server. This method is faster than a standard brute-force attack if the user has chosen a common password. What is this type of attack called?

Answer: Dictionary Attack

A dictionary attack uses a predefined list of words, phrases, or known passwords (a 'dictionary' or 'wordlist') to attempt to guess a password. [5, 13] This is generally much faster than a brute-force attack, which tries all possible combinations, but its success depends on the password being in the list. [1]