OSCP Password Attacks and Cracking

Question 1

What is the difference between online and offline password attacks?

Accepted Answer

Online attacks guess passwords against live services; offline attacks crack captured hashes without network interaction

Answer

Online attacks authenticate against live services (SSH, FTP, RDP) and are rate-limited and detectable, while offline attacks crack captured password hashes locally without network interaction.

Question 2

What tool is commonly used in OSCP to brute-force SSH, FTP, and HTTP login services?

Accepted Answer

Hydra

Answer

Hydra is a fast and flexible network login cracker that supports dozens of protocols including SSH, FTP, HTTP, SMB, and RDP, making it the primary online brute-force tool in OSCP.

Question 3

What Hydra command would brute-force SSH on host 10.10.10.10 using username 'admin' with the rockyou wordlist?

Accepted Answer

hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.10 ssh

Answer

The correct syntax uses -l for a single username, -P for a password list file, followed by the target IP and service name.

Question 4

What is a 'pass-the-hash' (PtH) attack and when is it used in OSCP?

Accepted Answer

Authenticating to Windows services using an NTLM hash directly without cracking it

Answer

Pass-the-hash allows an attacker to authenticate to Windows services (SMB, WMI, RDP) using a captured NTLM hash directly, without needing to crack it to plaintext.

Question 5

What type of hash does Windows use by default for local account authentication in modern systems?

Accepted Answer

NTLM (NT hash)

Answer

Modern Windows systems use NTLM hashes (specifically the NT hash, which is MD4 of the Unicode password) for local authentication stored in the SAM database.

OSCP - Offensive Security Certified Professional Practice Test

OSCP - Offensive Security Certified Professional Practice Test

OSCP Password Attacks and Cracking