Attacking Password Hashes GPEN Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   During an assessment, a penetration tester captures a hash that begins with the string '$2y$'. Which hash type is most likely represented?

   • ASHA-256
   • BLM
   • CNTLM
   • Dbcrypt
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of an account lockout policy?

   • ATo prevent online brute-force attacks by locking accounts after repeated failures
   • BTo encrypt password hashes in the database
   • CTo force users to change passwords regularly
   • DTo prevent offline cracking of password hashes
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   You have captured a hash from a Windows system that is stored in the SAM file. The hash is 32 hexadecimal characters and does not have a prefix. You need to crack it, but you are unsure if it is LM or NTLM. How can you determine the type?

   • ANTLM hashes are always 32 hex characters, LM hashes are 16
   • BCheck the length: LM hashes are 32 hex characters, NTLM hashes are also 32 hex characters, so length alone is insufficient; you need to check the context or use a tool that identifies the hash
   • CLM hashes are uppercase and NTLM hashes are lowercase
   • DLM hashes have a `$LM$` prefix, NTLM hashes have `$NT$`
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   You are testing a web application that uses Active Directory for authentication. The account lockout policy is set to 5 failed attempts within 15 minutes. You have a list of 1,000 common passwords and a list of 500 valid usernames. Which attack strategy minimizes the risk of locking out accounts while still testing many credentials?

   • ARun a brute-force attack with a tool that automatically resets the account after each failure.
   • BTry one password against all usernames, then wait 15 minutes before trying the next password.
   • CUse a single username with a list of 1,000 passwords but pause every 4 attempts for 14 minutes.
   • DTry all 1,000 passwords against one username, then move to the next username.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of a password spraying attack?

   • ATo try many passwords against a single user account
   • BTo capture password hashes from network traffic
   • CTo crack captured hashes using a dictionary
   • DTo try a small number of common passwords against many user accounts
   Reveal Solution Discussion Select an answer first