Password Attacks GPEN Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   A tester uses a wordlist containing 'Summer' and applies a rule that appends '2024' to each word. Which attack technique is being used?

   • APass-the-ticket attack
   • BHybrid attack
   • CRainbow table attack
   • DBrute-force attack
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A tester has a large set of unsalted MD5 password hashes from a legacy system. The tester wants to recover plaintext passwords as quickly as possible with limited GPU resources. Which approach is most efficient?

   • APerform a hybrid attack appending numbers to dictionary words.
   • BRun a brute-force attack with all 8-character lowercase combinations.
   • CUse a precomputed rainbow table for unsalted MD5 to look up the hashes.
   • DUse a rule-based attack with a large wordlist and many rules.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Why is credential stuffing often successful?

   • ABecause it exploits weak encryption algorithms.
   • BBecause it bypasses multi-factor authentication.
   • CBecause users tend to reuse the same passwords across multiple accounts.
   • DBecause it uses brute-force to guess passwords.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   During a penetration test, a tester captures password hashes from a compromised system and then attempts to crack them offline on a powerful workstation. Which statement best describes this approach?

   • AIt is an online attack because the tester is using real user credentials.
   • BIt is a passive attack because the tester is only observing network traffic.
   • CIt is an offline attack because the tester can attempt many guesses without contacting the target system.
   • DIt is a hybrid attack because it combines dictionary words and brute-force techniques.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A tester needs to determine whether a password is weak. The tester has access to a hash of the password and can attempt unlimited offline guesses. Which type of attack is this?

   • APassword spraying attack, because many accounts are targeted.
   • BPass-the-hash attack, because the hash is used directly.
   • COffline attack, because the tester can try guesses without interacting with the target system.
   • DOnline attack, because the tester is attempting to log in.
   Reveal Solution Discussion Select an answer first