CEH Enumeration and System Hacking Practice Question
During an internal penetration test, an analyst uses `enum4linux -a 10.0.0.5` and retrieves a list of local users, including an account named 'sqlsvc'. The analyst then attempts to crack the password using a dictionary attack. Which password cracking tool would be most efficient for this task?
⚠ Common exam trap
EC-Council often tests the distinction between dictionary attacks and rainbow table attacks, leading candidates to choose RainbowCrack or Ophcrack when the question explicitly specifies a dictionary attack method.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
John the Ripper
John the Ripper is the most efficient tool for performing a dictionary attack against password hashes retrieved from a system, such as those obtained from the SAM database or via enum4linux. It supports a wide range of hash types and can be configured to use custom wordlists, making it ideal for cracking the 'sqlsvc' account password in an internal penetration test.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RainbowCrack
Why it's wrong here
RainbowCrack is a password cracking tool that primarily utilizes precomputed rainbow tables to reverse cryptographic hashes into their plaintext equivalents. While effective for certain hash types, its methodology differs significantly from a dictionary attack, which involves testing a list of common passwords or phrases. Therefore, it is not the most appropriate choice when the goal is to perform a dictionary attack on hashes potentially extracted from SMB enumeration.
- ✗
SNMPwalk
Why it's wrong here
SNMPwalk is a command-line tool used for enumerating information from devices that support the Simple Network Management Protocol (SNMP). It allows an analyst to query SNMP agents for details like system information, network interfaces, and running processes. However, SNMPwalk is purely an enumeration tool for network management data and lacks any functionality for password cracking or processing SMB-related output from tools like enum4linux.
- ✓
John the Ripper
Why this is correct
John the Ripper is a robust, open-source password cracking utility widely recognized for its versatility in performing dictionary attacks against a multitude of hash types. It can efficiently process password hashes, including NTLM and LM hashes commonly found in Windows environments and potentially extracted or identified through SMB enumeration tools like enum4linux. Its extensive wordlist support and customizable rules make it an ideal choice for attempting to crack enumerated user passwords via dictionary attack.
- ✗
Ophcrack
Why it's wrong here
Ophcrack is a specialized password cracker designed specifically for Windows LM and NTLM hashes, relying heavily on precomputed rainbow tables for rapid cracking. While highly efficient for its intended purpose, it requires these large, pre-generated tables to function, which can be resource-intensive to acquire or generate. Unlike John the Ripper, Ophcrack is not primarily designed for flexible dictionary attacks with custom wordlists, making it less suitable for a general dictionary attack scenario.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.