Password Cracking Techniques EHE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which password cracking technique uses a precomputed set of hash chains to reverse hashes quickly?

   • AHybrid attack
   • BBrute force attack
   • CDictionary attack
   • DRainbow table attack
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security consultant is using Hashcat to crack NTLM hashes from a Windows system. The consultant has a wordlist but wants to also try common variations like 'Password1' and 'Summer2023!'. Which Hashcat feature should the consultant use to generate these variations from the wordlist?

   • AUse the '--rules' option with a rule file that applies transformations like appending digits and symbols.
   • BUse the '--show' option to display already cracked passwords.
   • CUse the '--increment' option to perform a brute force attack after the wordlist is exhausted.
   • DUse the '--stdout' option to output the wordlist to a file for manual editing.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst is using Hashcat to crack password hashes. The analyst has a wordlist of common passwords but wants to also try common variations like 'Password1' and 'Summer2023!'. Which Hashcat feature should the analyst use?

   • AUse the '--stdout' option to output the wordlist to a file for manual editing.
   • BUse the '--increment' option to perform a brute force attack after the wordlist is exhausted.
   • CUse the '--rules' option with a rule file that applies transformations like appending digits and symbols.
   • DUse the '--show' option to display already cracked passwords.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security auditor is testing the password policy of a small company. The policy currently requires passwords of at least 8 characters, but the auditor finds that many users choose predictable patterns like 'Company2023'. The auditor wants to demonstrate the risk of brute force attacks against short, predictable passwords during a penetration test. Which approach best demonstrates this risk while staying within the scope of the assessment?

   • APerform a hybrid attack by appending numbers to dictionary words to crack passwords like 'Company2023'.
   • BUse rainbow tables to reverse the hashes of the password database and show that weak passwords are easily recovered.
   • CUse a dictionary attack with a wordlist of common passwords against all user accounts to show that many use weak passwords.
   • DRun a brute force attack against a test account with an 8-character password using only lowercase letters to show how quickly it can be cracked.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company's IT team discovers that a legacy application stores user passwords as unsalted MD5 hashes. They are planning to migrate to a modern authentication system. During the transition, they want to assess the risk of the existing password database being cracked. Which factor most significantly increases the risk of these hashes being cracked?

   • AUsers tend to choose weak passwords, but this is a general risk and not specific to the unsalted MD5 storage format.
   • BThe hashes are stored in a plaintext file, which is a separate issue but does not directly affect the cryptographic strength of the hashes.
   • CMD5 is a fast hashing algorithm, but its speed is not the primary factor; the lack of salt is more critical for rainbow table attacks.
   • DThe use of MD5 without salt allows identical passwords to produce identical hashes, making precomputed rainbow tables highly effective.
   Reveal Solution Discussion Select an answer first