CEH Day 6 Password Cracking

What is a password attack?

An attempt to obtain guess recover or misuse credentials to gain unauthorized access

What is an online password attack?

An attack where the attacker interacts directly with the authentication service

What is an offline password attack?

An attack where the attacker obtains password hashes or credential material and performs guessing or cracking locally

What is the key difference between online and offline password attacks?

Online attacks interact with the target authentication service while offline attacks work with stolen credential material on the attacker's machine

Why can account lockout help against online password attacks?

It can temporarily prevent further authentication attempts after too many failed attempts

Why does account lockout not directly stop offline password cracking?

Offline cracking does not interact with the original authentication service so its lockout mechanism is not involved

What is a dictionary attack?

An attack that tests password candidates from a predefined wordlist

What is the main clue for identifying a dictionary attack?

The use of a wordlist containing common or likely passwords

What is a brute-force attack?

An attack that systematically tries possible combinations from a defined character set

What is the main clue for identifying a brute-force attack?

The systematic testing of possible character combinations

What is the formula for the number of possible combinations in a brute-force search?

C to the power of L where C is the character set size and L is the password length

How many combinations exist for 26 lowercase letters and a four character password?

456976

What is a hybrid password attack?

An approach that combines a dictionary with predictable modifications to candidate passwords

What is a rule-based password attack?

An attack that applies predefined transformation rules to password candidates

What are examples of password transformation rules?

Capitalization numbers symbols substitutions prefixes and suffixes

What is the relationship between hybrid and rule-based attacks?

A hybrid attack can use rules to transform dictionary candidates into likely password variations

What is password spraying?

An attack that tries one or a small number of common passwords against many user accounts

Why is password spraying used by attackers?

It can reduce the chance of triggering account lockout on an individual account

What is the main clue for identifying password spraying?

The same password or small set of passwords is tried against many accounts

What is credential stuffing?

An attack that uses stolen username and password pairs from one service against another service

What weakness does credential stuffing exploit?

Password reuse across different services

What is the key difference between password spraying and credential stuffing?

Spraying uses common passwords against many accounts while stuffing reuses stolen username and password pairs

What is hashing?

A one way transformation that converts input into a fixed length hash value for a particular algorithm

What does deterministic mean in hashing?

The same input produces the same hash when processed by the same hash function

Is hashing normally reversible?

No hashing is designed as a one way transformation

Can a password hash normally be decrypted with a key?

No a hash is not normally decrypted

What is the difference between hashing and encryption?

Hashing is designed to be one way while encryption is designed to be reversible with the appropriate key

Why can a password hash still be cracked?

An attacker can generate candidate passwords hash them and compare the results with the stolen hash

What happens when a tiny change is made to a password before hashing?

The resulting hash can change dramatically

What is a salt in password storage?

Random additional data combined with a password before hashing

Why are salts used with password hashes?

They help prevent identical passwords from producing identical stored hashes and make precomputed attacks less useful

What happens when two users have the same password but different salts?

Their password hashes will generally be different

Does salting make offline password cracking impossible?

No an attacker can still perform offline guessing against salted hashes

What is a rainbow table?

A precomputed collection of password and hash relationships used to speed up password recovery

Why are rainbow tables useful against unsalted hashes?

An attacker can compare a stolen hash with precomputed hash values without calculating every candidate from scratch

Why do unique salts make rainbow tables much less useful?

The salt changes the input to the hash function so generic precomputed hashes do not directly match the salted hash

What is the classic CEH defense against rainbow table attacks?

Salting

What is Hashcat?

A password and hash cracking tool primarily associated with offline cracking

What is a major Hashcat clue in a CEH question?

GPU acceleration or high performance password hash cracking

What is John the Ripper?

A password cracking and auditing tool primarily associated with offline password and hash cracking

What is a useful John the Ripper clue?

Password auditing or traditional Unix and Linux password file contexts

What is the key relationship between Hashcat and John the Ripper?

Both are major tools for offline password and hash cracking

What is Hydra?

A tool primarily associated with online password attacks against network authentication services

What is a useful Hydra clue?

Automated login attempts against multiple network services or protocols

What is Medusa?

A tool primarily associated with online network authentication and password guessing

What is a useful Medusa clue?

Modular or parallelized network authentication attacks

What is the basic tool distinction between Hashcat and John versus Hydra and Medusa?

Hashcat and John primarily work with hashes offline while Hydra and Medusa primarily interact with live authentication services

What is the best first question when identifying a password cracking tool?

Does the attacker have a hash or are they interacting with a live login service

Which tools are primarily associated with offline hash cracking?

Hashcat and John the Ripper

Which tools are primarily associated with online network authentication attacks?

Hydra and Medusa

What clue strongly points to Hashcat rather than John the Ripper?

GPU acceleration

What clue can point toward John the Ripper?

Password auditing involving traditional Unix or Linux password files

What clue strongly points toward Hydra?

Broad online attacks against network authentication services

What clue can point toward Medusa?

Modular or parallelized network authentication attacks

What is LM?

LAN Manager which is a legacy Windows password hashing scheme with significant weaknesses

What are major weaknesses associated with LM?

A 14 character limitation effective splitting into two 7 character portions and case insensitivity

What is the main CEH memory hook for LM?

LM means legacy and weak

What is NTLM?

A Microsoft authentication and password hash related technology commonly encountered in Windows password attacks

What can an attacker do with obtained NTLM password hashes?

They can attempt offline password cracking or potentially use techniques such as Pass the Hash depending on the context

What is NTLMv2?

A Microsoft authentication protocol or version that improves the authentication process through challenge response mechanisms

Is NTLMv2 simply the name of a stronger NTLM password hash?

No NTLMv2 primarily refers to an authentication protocol or version

What is Pass the Hash?

A technique where an attacker uses a valid password hash directly for authentication without recovering the plaintext password

What is the key clue for Pass the Hash?

The attacker authenticates using the hash without needing to know the plaintext password

What is the difference between offline cracking and Pass the Hash?

Offline cracking attempts to recover the password from a hash while Pass the Hash uses the hash directly for authentication

What is credential dumping?

A technique for obtaining credential material from a compromised system

What types of material can credential dumping potentially obtain?

Password hashes cached credentials authentication tokens and other credential information

What is the difference between credential dumping and offline cracking?

Credential dumping obtains credential material while offline cracking uses obtained material to try to recover passwords

What is the three step distinction between credential dumping offline cracking and Pass the Hash?

Dump obtains the credential material crack attempts to recover the password and Pass the Hash uses the hash directly

What is Kerberoasting?

An Active Directory attack involving Kerberos service ticket material associated with accounts having Service Principal Names that can be subjected to offline cracking

What is the strongest CEH clue for Kerberoasting?

Kerberos plus an SPN associated with a service account

What is an SPN?

A Service Principal Name associated with a service account in an Active Directory environment

What happens conceptually during Kerberoasting?

An attacker obtains Kerberos service ticket material associated with a service account and attempts to crack it offline

What is AS REP Roasting?

An Active Directory attack involving AS REP responses from accounts where Kerberos preauthentication is not required

What is the strongest CEH clue for AS REP Roasting?

Kerberos plus disabled or missing preauthentication

What happens conceptually during AS REP Roasting?

An attacker obtains AS REP response material and attempts to crack it offline

What is the key distinction between Kerberoasting and AS REP Roasting?

Kerberoasting is associated with SPNs and service accounts while AS REP Roasting is associated with accounts that do not require Kerberos preauthentication

What is the memory hook for Kerberoasting?

KERBERO means service

What is the memory hook for AS REP Roasting?

AS REP means no preauthentication

What is account lockout?

A control that locks an account after a defined number of failed authentication attempts

Which attacks can account lockout help defend against?

Online brute force and dictionary attacks

What is rate limiting?

A control that slows repeated authentication attempts without necessarily locking the account

What is the difference between account lockout and rate limiting?

Lockout stops further attempts while rate limiting allows attempts but slows them down

Which attacks can rate limiting help defend against?

Automated online brute force and dictionary attacks

What is CAPTCHA?

A mechanism designed to distinguish human users from automated activity

What type of password attacks can CAPTCHA help mitigate?

Automated online password attacks

What is MFA?

Multi factor authentication requiring more than one authentication factor

Why is MFA effective against password attacks?

Knowing the password alone is insufficient to authenticate

Which password attacks can MFA help mitigate?

Brute force dictionary attacks password spraying and credential stuffing

Why are long passwords harder to brute force?

They increase the size of the search space

What is the relationship between password length and brute force search space?

Increasing password length can dramatically increase the number of possible combinations

What is a secure password hashing or KDF approach?

A password storage mechanism designed to make password guessing computationally expensive

What are examples of password hashing or KDF approaches?

Argon2 bcrypt scrypt and PBKDF2

What is the main purpose of a password KDF?

To make each password guessing attempt more computationally expensive

How can strong unique passwords help defend against credential stuffing?

A unique password cannot be reused successfully on another service even if credentials from one service are compromised

What defenses are useful against credential stuffing?

Unique passwords MFA breached password detection and monitoring for suspicious authentication

What defenses are useful against password spraying?

MFA rate limiting weak password blocking and monitoring authentication attempts across many accounts

Why should authentication monitoring look across multiple accounts for password spraying?

The same password may be tried once against many accounts without triggering an individual account threshold

What is the main defense against rainbow tables?

Unique salts

What is the main defense principle against offline cracking?

Use strong unique passwords and secure password hashing or KDF mechanisms with unique salts

Which defense does not directly interfere with offline cracking of stolen hashes?

Account lockout on the original authentication service