OSCP Password Attacks and Cracking 1 — Questions and Answers
Question 1: What is the difference between online and offline password attacks?
- Online attacks target web applications; offline attacks target desktop apps
- Online attacks guess passwords against live services; offline attacks crack captured hashes without network interaction (Correct answer)
- Online attacks require internet access; offline attacks work on a local network
- Online attacks use wordlists; offline attacks use brute force only
Correct answer: Online attacks guess passwords against live services; offline attacks crack captured hashes without network interaction
Online attacks authenticate against live services (SSH, FTP, RDP) and are rate-limited and detectable, while offline attacks crack captured password hashes locally without network interaction.
Question 2: What tool is commonly used in OSCP to brute-force SSH, FTP, and HTTP login services?
- John the Ripper
- Hydra (Correct answer)
- Hashcat
- CrackMapExec
Correct answer: Hydra
Hydra is a fast and flexible network login cracker that supports dozens of protocols including SSH, FTP, HTTP, SMB, and RDP, making it the primary online brute-force tool in OSCP.
Question 3: What Hydra command would brute-force SSH on host 10.10.10.10 using username 'admin' with the rockyou wordlist?
- hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.10 ssh (Correct answer)
- hydra -u admin -w /usr/share/wordlists/rockyou.txt ssh://10.10.10.10
- hydra --user admin --wordlist rockyou.txt --service ssh 10.10.10.10
- hydra -U admin -L rockyou.txt 10.10.10.10:22
Correct answer: hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.10 ssh
The correct syntax uses -l for a single username, -P for a password list file, followed by the target IP and service name.
Question 4: What is a 'pass-the-hash' (PtH) attack and when is it used in OSCP?
- Cracking an NTLM hash and using the plaintext password
- Authenticating to Windows services using an NTLM hash directly without cracking it (Correct answer)
- Passing a hash to a password cracker for offline analysis
- Hashing a plaintext password to bypass a password strength requirement
Correct answer: Authenticating to Windows services using an NTLM hash directly without cracking it
Pass-the-hash allows an attacker to authenticate to Windows services (SMB, WMI, RDP) using a captured NTLM hash directly, without needing to crack it to plaintext.
Question 5: What type of hash does Windows use by default for local account authentication in modern systems?
- MD5
- SHA-256
- NTLM (NT hash) (Correct answer)
- bcrypt
Correct answer: NTLM (NT hash)
Modern Windows systems use NTLM hashes (specifically the NT hash, which is MD4 of the Unicode password) for local authentication stored in the SAM database.
Question 6: Which hashcat attack mode uses a wordlist to crack password hashes?
- Mode 3 (Mask attack)
- Mode 0 (Straight/Wordlist attack) (Correct answer)
- Mode 6 (Hybrid Wordlist + Mask)
- Mode 1 (Combination attack)
Correct answer: Mode 0 (Straight/Wordlist attack)
Hashcat mode 0 (straight attack) uses a wordlist file, testing each word as a potential password, making it the most common starting point for cracking captured hashes.
OSCP Password Attacks and Cracking 1
What is the difference between online and offline password attacks?