eJPT Password Attacks and Cracking 5 — Questions and Answers
Question 1: Which command correctly invokes Hydra to brute-force SSH on a non-standard port 2222?
- hydra -l admin -P passwords.txt ssh://target -port 2222
- hydra -l admin -P passwords.txt -s 2222 target ssh (Correct answer)
- hydra -l admin -P passwords.txt target -proto ssh -p 2222
- hydra -u admin -w passwords.txt target:2222/ssh
Correct answer: hydra -l admin -P passwords.txt -s 2222 target ssh
Hydra uses -s to specify a non-standard port, so 'hydra -l admin -P passwords.txt -s 2222 target ssh' targets SSH on port 2222.
Question 2: What is the main advantage of bcrypt over MD5 for password storage?
- bcrypt produces longer hashes that take more storage space
- bcrypt is intentionally slow and includes a work factor that makes brute-force cracking much harder (Correct answer)
- bcrypt is a symmetric cipher while MD5 is a hash function
- bcrypt automatically salts hashes while MD5 does not support salting
Correct answer: bcrypt is intentionally slow and includes a work factor that makes brute-force cracking much harder
bcrypt uses a configurable work factor (cost parameter) that makes it computationally expensive to compute, drastically slowing brute-force and dictionary attacks compared to fast hashes like MD5.
Question 3: When performing a password attack, what does the term 'offline cracking' mean?
- Cracking passwords without an internet connection
- Cracking captured hashes on a local machine without interacting with the target service (Correct answer)
- Using an offline dictionary that isn't indexed by search engines
- Attacking a server that is currently offline
Correct answer: Cracking captured hashes on a local machine without interacting with the target service
Offline cracking means you've obtained hash values and crack them locally, avoiding account lockouts and network detection since you're not making login attempts against the live service.
Question 4: Which eJPT-relevant scenario best describes when you would use Mimikatz's 'sekurlsa::logonpasswords' module?
- To crack WPA2 handshake files
- To dump cleartext credentials and hashes from Windows LSASS process memory after gaining admin access (Correct answer)
- To perform SQL injection against a Windows login page
- To extract SSH private keys from a Linux server
Correct answer: To dump cleartext credentials and hashes from Windows LSASS process memory after gaining admin access
sekurlsa::logonpasswords dumps credentials cached in the LSASS process memory on Windows, often revealing cleartext passwords of recently logged-in users, but requires admin/SYSTEM privileges.
Question 5: What flag in John the Ripper specifies using a custom wordlist for cracking?
- john --dict=wordlist.txt hash.txt
- john --wordlist=wordlist.txt hash.txt (Correct answer)
- john --list=wordlist.txt hash.txt
- john --file=wordlist.txt hash.txt
Correct answer: john --wordlist=wordlist.txt hash.txt
The --wordlist flag in John the Ripper specifies the path to a custom wordlist file, as in 'john --wordlist=rockyou.txt hashes.txt'.
Question 6: What is the risk of high thread counts (-t flag) when using Hydra against a live service?
- It causes Hydra to crash on the attacker's machine
- It can trigger account lockouts, IDS alerts, or overwhelm the target service (Correct answer)
- It slows down the attack because threads compete for CPU
- It automatically limits attempts to avoid detection
Correct answer: It can trigger account lockouts, IDS alerts, or overwhelm the target service
Too many concurrent threads in Hydra can lock accounts, trigger intrusion detection alerts, or even crash unstable services, making it important to tune thread counts carefully.
Question 7: Which hash type would you specify with '-m 22000' in Hashcat?
- NTLM
- WPA2-PBKDF2-PMKID+EAPOL (Correct answer)
- bcrypt
- SHA-512crypt
Correct answer: WPA2-PBKDF2-PMKID+EAPOL
Hashcat mode 22000 targets WPA2 (PBKDF2-HMAC-SHA1) hashes in the modern hcwpax format, used to crack captured Wi-Fi handshakes.
eJPT Password Attacks and Cracking 5
Which command correctly invokes Hydra to brute-force SSH on a non-standard port 2222?