OSCP Password Attacks and Cracking 3

Question 1

What is credential spraying and why is it preferred over traditional brute-force in Active Directory environments?

Accepted Answer

Testing one password against all users avoids account lockout policies that trigger after multiple failed attempts per account

Answer

It is faster than brute-force because it uses GPU acceleration

Answer

It bypasses network firewalls by distributing attack traffic

Answer

It only requires one network packet per attempt, reducing bandwidth

Question 2

What is John the Ripper's primary use case versus hashcat in an OSCP context?

Accepted Answer

John is CPU-based and good for auto-detecting hash types; hashcat is GPU-accelerated and faster for bulk cracking

Answer

John handles only Linux hashes; hashcat handles only Windows hashes

Answer

John cracks passwords online; hashcat only works offline

Answer

John supports more protocols; hashcat only supports common algorithms

Question 3

Which tool can extract password hashes from a Windows system remotely using administrative credentials over SMB?

Accepted Answer

secretsdump.py (impacket)

Answer

Mimikatz /remote

Answer

pwdump7 --remote

Answer

fgdump --smb

Question 4

What is the default password for many network devices and why is testing for default credentials important in OSCP?

Accepted Answer

Vendors ship devices with known default credentials that administrators often forget to change, providing easy access

Answer

Default passwords are always 'admin/admin' across all vendors

Answer

Default credentials only work during initial device setup and expire automatically

Answer

Testing defaults is prohibited in OSCP engagement rules

Question 5

What is a mask attack in hashcat and when would you use it?

Accepted Answer

A mask attack defines character set patterns (e.g., 8 chars, uppercase + digits) to generate password candidates matching known policies

Answer

A mask attack filters which hashes to crack based on length

Answer

A mask attack hides the cracking operation from intrusion detection systems

Answer

A mask attack combines multiple wordlists with specific delimiters

Question 6

What is a Kerberoasting attack and what does it target?

Accepted Answer

Requesting service tickets for SPN-registered accounts and cracking the ticket's embedded hash offline

Answer

Brute-forcing Kerberos login passwords at the domain controller

Answer

Forging Kerberos tickets using a stolen krbtgt hash

Answer

Intercepting Kerberos AS-REQ packets from client machines