CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Using a wordlist to try every possible password in the list

  Why it's wrong here

  This describes a pure dictionary attack, where an attacker attempts to crack passwords by comparing hashes against a predefined list of common words, phrases, or previously leaked credentials. It is not considered a hybrid attack because it does not involve systematic modifications or combinations of these dictionary words with other character sets or patterns; it strictly relies on the integrity of the wordlist itself.

• ✓

  Using a dictionary file and appending random numbers to each word

  Why this is correct

  This is a classic example of a hybrid password attack, combining elements of a dictionary attack with a targeted brute-force component. By taking words from a dictionary file and systematically appending numerical sequences (e.g., 'password123', 'summer2024'), the attack efficiently targets common user password patterns that involve adding digits to memorable words. This method significantly expands the attack surface beyond a simple dictionary without resorting to a full, computationally expensive brute-force approach.

• ✓

  Using a set of rules with Hashcat to modify dictionary words (e.g., leet speak substitutions)

  Why this is correct

  This accurately describes a hybrid attack, leveraging the power of rule-based password generation. Tools like Hashcat can apply sophisticated rulesets to dictionary words, systematically transforming them through operations such as leet speak substitutions (e.g., 'password' to 'p4ssw0rd'), character capitalization changes, or appending/prepending common symbols. This method intelligently generates a vast array of probable password variations, effectively combining dictionary knowledge with algorithmic modifications to mimic common user password creation habits.

• ✗

  Generating all possible character combinations up to a certain length

  Why it's wrong here

  This represents a pure brute-force attack, which systematically tries every possible character combination within a defined character set (e.g., alphanumeric, special characters) up to a specified length. Unlike hybrid attacks, it does not leverage any pre-existing knowledge from dictionaries or common password patterns; instead, it exhaustively searches the entire keyspace. This method is computationally intensive and time-consuming, especially for longer or more complex passwords.

• ✗

  Cracking passwords using precomputed rainbow tables

  Why it's wrong here

  Cracking passwords using precomputed rainbow tables is a distinct technique focused on optimizing the reversal of cryptographic hashes, not a hybrid password guessing method. Rainbow tables are pre-generated data structures that store chains of hash and plaintext values, allowing for rapid lookup of a plaintext password given its hash. This approach bypasses the need for real-time password guessing or modification rules, making it a form of precomputation attack rather than a combination of dictionary and brute-force strategies.

Go deeper

Related to this question