CEH Enumeration and System Hacking Practice Question

Which TWO of the following tools are capable of cracking password hashes offline? (Select 2)

⚠ Common exam trap

It's easy for candidates to confuse online brute-forcing tools (like Hydra) with offline hash crackers, because both are used for password attacks, but Hydra requires a live target service and cannot process a static hash file.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Hashcat

Hashcat is a high-performance password recovery tool that supports offline cracking of password hashes using GPU acceleration. It can process a wide range of hash types (e.g., MD5, SHA-1, bcrypt, NTLM) by comparing precomputed or brute-force generated hashes against a target hash file, all without interacting with a live authentication server.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Hashcat
Why this is correct
Hashcat is an advanced offline password recovery utility renowned for its unparalleled speed, primarily achieved through extensive GPU acceleration. It supports a vast array of hash types, including NTLM, MD5, SHA-1, and bcrypt, and offers diverse attack modes such as dictionary, brute-force, mask, and hybrid attacks. This makes it exceptionally effective for cracking password hashes extracted from compromised systems or databases, enabling rapid auditing of password security.
✗
Hydra
Why it's wrong here
Hydra is a robust online password cracking tool designed to perform rapid brute-force and dictionary attacks against various network services and authentication protocols. Unlike offline crackers, Hydra directly attempts credentials against live services like SSH, FTP, HTTP, and SMB, making it suitable for testing the strength of network service authentication. It does not process pre-obtained password hashes but rather interacts with the target service in real-time to guess login credentials.
✓
John the Ripper
Why this is correct
John the Ripper, often abbreviated as JtR, is a widely recognized and versatile offline password cracking utility. It excels at detecting weak passwords by supporting numerous hash and cipher types, including Unix crypt, Windows NTLM, and Kerberos, and employs various attack strategies such as dictionary attacks, brute-force, and single crack mode. JtR is an essential tool for security professionals to audit password strength from collected hash dumps and identify vulnerabilities.
✗
Nmap
Why it's wrong here
Nmap, or Network Mapper, is fundamentally a network discovery and security auditing tool, not a password cracker. Its primary functions involve host discovery, port scanning, service version detection, and operating system fingerprinting across networks. While it can identify potential vulnerabilities in services, Nmap does not possess any built-in capabilities for cracking password hashes or performing credential brute-force attacks against discovered services.
✗
Wireshark
Why it's wrong here
Wireshark is a powerful network protocol analyzer used for capturing and interactively examining network traffic in real-time or from saved packet capture files. Its core functionality involves deep inspection of individual packets to understand network communication, diagnose issues, and analyze protocol behavior. Although it can reveal plaintext credentials if they traverse the network unencrypted, Wireshark itself is a passive monitoring tool and does not actively crack passwords or hashes.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question