eJPT Password Attacks and Cracking 4 — Questions and Answers
Question 1: Which tool is used to extract password hashes from a Windows SAM database?
- Hydra
- Medusa
- Mimikatz (Correct answer)
- Aircrack-ng
Correct answer: Mimikatz
Mimikatz is a post-exploitation tool that can extract NTLM hashes, plaintext credentials, and Kerberos tickets from Windows memory and the SAM database.
Question 2: What is the purpose of the 'unshadow' command in John the Ripper?
- It removes shadow copies from Windows
- It combines /etc/passwd and /etc/shadow into a single crackable file (Correct answer)
- It decrypts shadow files using AES
- It converts NTLM hashes to Linux format
Correct answer: It combines /etc/passwd and /etc/shadow into a single crackable file
The unshadow command merges /etc/passwd and /etc/shadow into a single file in the format John the Ripper needs to crack Linux password hashes.
Question 3: In Hashcat mask attacks, what character set does '?d' represent?
- All printable characters
- Digits 0-9 (Correct answer)
- Lowercase letters a-z
- Special characters
Correct answer: Digits 0-9
In Hashcat mask syntax, ?d represents the digit character set (0-9), ?l is lowercase, ?u is uppercase, and ?s is special characters.
Question 4: Which attack method is most effective against WPA2 Wi-Fi passwords?
- ARP poisoning followed by NTLM relay
- Capturing the 4-way handshake and performing offline dictionary/brute-force cracking (Correct answer)
- Deauthentication then pass-the-hash
- SQL injection into the router admin panel
Correct answer: Capturing the 4-way handshake and performing offline dictionary/brute-force cracking
WPA2 cracking requires capturing the 4-way EAPOL handshake (using tools like airodump-ng), then cracking the PBKDF2-HMAC-SHA1 hash offline with Hashcat or Aircrack-ng.
Question 5: What is a hybrid attack in the context of password cracking?
- An attack combining online and offline cracking simultaneously
- An attack that combines a wordlist with a brute-force mask appended or prepended to each word (Correct answer)
- An attack using both Windows and Linux hash formats
- A simultaneous attack on multiple protocols
Correct answer: An attack that combines a wordlist with a brute-force mask appended or prepended to each word
A hybrid attack takes words from a dictionary and appends or prepends brute-force character combinations to each word, targeting passwords like 'password123' or 'abc!password'.
Question 6: Which Medusa flag specifies the password file to use during a brute-force attack?
- -p
- -P (Correct answer)
- -w
- -W
Correct answer: -P
In Medusa, -P specifies a file containing a list of passwords to try, while -p specifies a single password to test.
Question 7: What is a hash collision in the context of password security?
- When two different network packets have the same checksum
- When two different inputs produce the same hash output (Correct answer)
- When a hash function runs out of memory
- When rainbow tables are detected by an IDS
Correct answer: When two different inputs produce the same hash output
A hash collision occurs when two different plaintext inputs produce the same hash value, which can potentially be exploited to authenticate without knowing the original password.
eJPT Password Attacks and Cracking 4
Which tool is used to extract password hashes from a Windows SAM database?