CEH Enumeration and System Hacking Practice Question
During a penetration test, you receive a list of password hashes from a Windows server. Which of the following tools would be BEST suited to perform a dictionary attack against these hashes?
⚠ Common exam trap
EC-Council often tests the distinction between tools that capture hashes (like Metasploit's hashdump) versus tools that crack them (like John the Ripper), leading candidates to mistakenly choose Metasploit for the cracking phase.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
John the Ripper
John the Ripper is a dedicated password cracking tool that supports dictionary attacks against various hash types, including Windows NTLM hashes. It takes the list of hashes and compares them against a wordlist of candidate passwords, making it the best choice for this task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Nmap
Why it's wrong here
Nmap is a powerful network scanner primarily used for host discovery, port scanning, OS detection, and identifying services running on target systems. While essential for reconnaissance and vulnerability assessment, it lacks any built-in functionality or algorithms designed to process, decrypt, or crack password hashes obtained from a list, making it unsuitable for this specific task.
- ✓
John the Ripper
Why this is correct
John the Ripper is a dedicated, open-source password cracking tool specifically engineered to detect weak passwords in various systems. It excels at processing lists of password hashes, employing sophisticated techniques such as dictionary attacks, brute-force methods, and single crack modes to efficiently recover the original plaintext passwords from their hashed representations.
- ✗
Wireshark
Why it's wrong here
Wireshark functions as a network protocol analyzer, capturing and interactively browsing network traffic in real-time or from saved packet capture files. Its primary role is deep inspection of individual packets for troubleshooting, analysis, and security auditing, but it does not possess the capability to perform offline password hash cracking on a provided list of hashes.
- ✗
Metasploit
Why it's wrong here
Metasploit is a comprehensive exploitation framework designed for developing, testing, and executing exploit code against remote targets during penetration tests. While it can facilitate post-exploitation activities like dumping hashes from a compromised system, its core functionality is not optimized for the dedicated, offline cracking of a list of password hashes, which requires specialized algorithms and performance.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.