GPEN Password Attacks and Formats Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  --format=bcrypt

  Why it's wrong here

  Bcrypt hashes typically start with $2a$, $2b$, or $2y$. The $6$ prefix is not bcrypt. Using this format would cause John to misinterpret the hash and likely fail to crack it. Bcrypt is a different algorithm, so this is incorrect.

• ✓

  --format=sha512crypt

  Why this is correct

  The hash prefix $6$ indicates SHA-512 crypt, which is the default for many Linux systems. John the Ripper uses the format name sha512crypt for this. Specifying this format ensures John applies the correct algorithm and iteration count (rounds). This is the correct choice for the given hash.

• ✗

  --format=md5crypt

  Why it's wrong here

  MD5 crypt hashes start with $1$. The given hash starts with $6$, which is SHA-512 crypt. MD5crypt is weaker and uses a different algorithm. Specifying this format would result in errors or no cracks. Therefore, this is not the correct format.

• ✗

  --format=descrypt

  Why it's wrong here

  DES crypt hashes are typically 13 characters long and do not have a $ prefix. The given hash has a $6$ prefix, indicating SHA-512 crypt. Descrypt is outdated and uses a different structure. Using this format would not work for the hash. Hence, it is incorrect.