CEH Enumeration and System Hacking Practice Question
An ethical hacker needs to crack a set of NTLM hashes obtained from a Windows system. Which tool would be MOST efficient for performing a dictionary attack with hybrid rules?
⚠ Common exam trap
EC-Council often tests the misconception that John the Ripper is the best all-around password cracker, but for GPU-accelerated hybrid dictionary attacks on NTLM hashes, Hashcat is the industry standard due to its speed and rule engine.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hashcat
Hashcat is the most efficient tool for performing a dictionary attack with hybrid rules because it is GPU-accelerated, supports the NTLM hash mode (1000), and allows the application of rule-based mutations (e.g., appending digits or special characters) directly to dictionary words. Its speed and flexibility in handling large wordlists with complex rule sets make it superior for cracking NTLM hashes in a professional penetration test.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
John the Ripper
Why it's wrong here
While John the Ripper (JtR) is a versatile password cracker supporting NTLM, its primary strength lies in CPU-based dictionary and brute-force attacks. For modern NTLM hash cracking, especially when dealing with large sets or complex passwords, JtR's GPU acceleration capabilities are often less optimized and thus significantly slower compared to tools specifically designed for GPU parallelism like Hashcat. This makes it a less efficient choice for obtaining NTLM hashes quickly.
- ✓
Hashcat
Why this is correct
Hashcat is the industry-standard password recovery tool, highly optimized for cracking NTLM hashes due to its unparalleled support for GPU acceleration. It efficiently leverages modern graphics cards to perform millions of guesses per second, significantly reducing cracking time. Furthermore, Hashcat offers a wide array of attack modes, including dictionary, brute-force, mask, and sophisticated hybrid attacks, making it exceptionally versatile and fast for obtaining NTLM hashes.
- ✗
Ophcrack
Why it's wrong here
Ophcrack is a dedicated tool primarily designed for cracking Windows LM and NTLM hashes using precomputed rainbow tables. While effective for simpler hashes or when precomputed tables are available, its reliance on these tables makes it less flexible for complex scenarios that require dynamic dictionary or hybrid attacks. It does not perform real-time dictionary or brute-force attacks efficiently, nor does it leverage GPU acceleration, rendering it unsuitable for a general 'crack a set of NTLM hashes' task that might require more robust methods.
- ✗
RainbowCrack
Why it's wrong here
RainbowCrack is a specialized utility focused exclusively on using precomputed rainbow tables to reverse cryptographic hashes, including NTLM. Its core functionality revolves around looking up hash values within these large tables to find the corresponding plaintext. However, this approach is limited by the availability and size of precomputed tables and is ineffective against hashes not present in the tables or when custom dictionary or hybrid attacks are required, unlike more versatile tools that generate guesses on-the-fly.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.