CEH Enumeration and System Hacking Practice Question
A penetration tester has obtained a copy of the SAM database from a Windows system. The hashes extracted include both LM and NTLM hashes. Which of the following tools would be MOST efficient to crack the NTLM hashes using a dictionary attack with GPU acceleration?
⚠ Common exam trap
Many candidates confuse Ophcrack's LM hash rainbow table capability with NTLM cracking, or assume John the Ripper's general-purpose nature makes it equally efficient for GPU-accelerated tasks, when Hashcat is the de facto standard for GPU-based password cracking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hashcat
Hashcat is the most efficient tool for GPU-accelerated dictionary attacks against NTLM hashes because it is purpose-built for high-speed password cracking using OpenCL and CUDA, directly leveraging GPU parallelism. It supports the NTLM hash mode (1000) and can process millions of hashes per second, far outperforming CPU-based tools like John the Ripper for this specific task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
John the Ripper
Why it's wrong here
John the Ripper, whilst capable of cracking NTLM hashes via dictionary attacks, does not achieve the peak GPU acceleration performance for this specific hash type. Its GPU implementation, though present, is typically less optimised for NTLM efficiency compared to tools built with a GPU-first architecture. This option is tempting because JtR is a highly versatile and widely used password cracker, supporting numerous hash types and attack modes. It would be a strong choice for general hash cracking where maximum GPU efficiency isn't the sole priority.
- ✗
Ophcrack
Why it's wrong here
Ophcrack primarily utilizes precomputed rainbow tables to crack LM and NTLM hashes, rather than performing dictionary attacks with GPU acceleration. While effective for older LM hashes and some NTLM, its method relies on extensive storage for precomputed data, limiting its flexibility and efficiency against modern, complex NTLM passwords. It does not leverage the parallel processing power of GPUs for on-the-fly hash cracking, making it less suitable for maximizing performance against a SAM database in a penetration testing scenario.
- ✓
Hashcat
Why this is correct
Hashcat is the industry-standard tool for high-performance password recovery, leveraging highly optimized GPU acceleration to crack a vast array of hash types, including NTLM (mode 1000). Its architecture is specifically designed to maximize parallel processing on graphics cards, enabling exceptionally fast dictionary attacks, brute-force, and hybrid attacks. This unparalleled efficiency makes Hashcat the optimal choice for rapidly cracking NTLM hashes obtained from a SAM database dump, significantly reducing the time required compared to CPU-based or rainbow table methods.
- ✗
RainbowCrack
Why it's wrong here
RainbowCrack is a dedicated tool for generating and utilizing rainbow tables, which are precomputed tables designed to reverse cryptographic hash functions. Unlike dictionary attack tools, RainbowCrack does not perform real-time dictionary lookups or leverage GPU acceleration for on-the-fly cracking. Its effectiveness is limited by the scope and size of the precomputed tables, making it less adaptable and generally slower for cracking modern NTLM hashes with complex passwords compared to GPU-accelerated dictionary or brute-force attacks.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.