CEH Enumeration and System Hacking Practice Question
During a password cracking session, a pentester uses a wordlist combined with rules to generate variations of each word. This approach is called a hybrid attack. Which tool, when used with a rule file, can perform such an attack?
⚠ Common exam trap
Watch out — candidates often confuse online brute-forcing tools like Hydra with offline hash-cracking tools like Hashcat, or mistakenly think rainbow-table tools (RainbowCrack, Ophcrack) can perform rule-based wordlist mutations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hashcat
Hashcat is a powerful password recovery tool that supports hybrid attacks by combining a wordlist with rule-based mutations. When used with a rule file (e.g., best64.rule), Hashcat applies transformations like prefixing, suffixing, or character substitution to each word, enabling efficient generation of password variations. This directly matches the hybrid attack described in the question.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RainbowCrack
Why it's wrong here
RainbowCrack is a specialized tool designed for cracking hashes using precomputed rainbow tables. It excels at quickly finding plaintext passwords for hashes that exist within its precomputed datasets, but it does not perform dynamic, rules-based hybrid attacks that combine wordlists with character masks or custom rulesets during the cracking process. Its methodology relies on lookup rather than iterative generation and testing based on complex rules.
- ✗
Ophcrack
Why it's wrong here
Ophcrack is specifically tailored for cracking LM and NTLM hashes, primarily utilizing precomputed rainbow tables optimized for these legacy Windows hash formats. While effective for its niche, it lacks the advanced functionality for performing flexible, rules-based hybrid attacks that dynamically modify dictionary words or apply complex character masks. Its operation is largely table-driven, not rule-driven for generating new password candidates.
- ✗
Hydra
Why it's wrong here
Hydra is a powerful online password cracking tool designed for brute-forcing login credentials against various network services and protocols, such as SSH, FTP, HTTP, and databases. It operates by attempting to log in to live services, making it unsuitable for offline hash cracking sessions where a pentester applies wordlists and rules to a captured hash file. Hydra's purpose is service authentication testing, not local hash decryption.
- ✓
Hashcat
Why this is correct
Hashcat is widely recognized as the world's fastest and most versatile password recovery tool, offering extensive support for various attack modes, including highly effective hybrid and rule-based attacks. Its `-a 6` (hybrid wordlist + mask) and `-a 7` (hybrid mask + wordlist) modes directly address hybrid cracking scenarios, while the `-r` option enables sophisticated rule-based modifications to dictionary words. This comprehensive capability makes Hashcat the ideal choice for dynamic, advanced password cracking sessions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.