Password Attacks GPEN Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is an example of a rule-based transformation?

   • AHashing each word with MD5.
   • BReplacing the letter 'a' with '@' in every word.
   • CRemoving duplicate words from the list.
   • DSorting the wordlist alphabetically.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A tester has a wordlist containing 'Summer', 'Winter', 'Spring', and 'Autumn'. The tester suspects users append the current year and a special character, such as 'Summer2024!'. Which Hashcat rule would generate this variation from the wordlist?

   • AA rule that appends '2024' and then appends '!' to each word
   • BA rule that reverses each word
   • CA rule that toggles the case of each character
   • DA rule that prepends '2024' and appends '!' to each word
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A penetration tester has administrative access to a Windows workstation and captures an NTLM hash for a domain user. The tester wants to access a file server using that user's privileges without cracking the hash. Which technique should the tester use?

   • APass-the-hash by using the NTLM hash to authenticate to the file server
   • BPass-the-ticket by injecting a forged Kerberos ticket
   • CCrack the hash offline with Hashcat and then use the plaintext password
   • DPerform a dictionary attack against the hash using a wordlist
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which tool is commonly used for high-speed password cracking with GPU acceleration?

   • AWireshark
   • BHashcat
   • CNmap
   • DMetasploit
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary advantage of using a wordlist in a dictionary attack?

   • AIt bypasses account lockout policies.
   • BIt works only against hashed passwords, not plaintext.
   • CIt reduces the number of guesses compared to trying all possible combinations.
   • DIt guarantees success against any password.
   Reveal Solution Discussion Select an answer first