GPEN Attacking Password Hashes Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Employing a hybrid attack that combines a wordlist with a mask for appending digits.

  Why this is correct

  A hybrid attack merges dictionary words with a mask, such as appending two digits to each word. This is highly effective against passwords that follow common patterns like 'password123'. Since NTLM hashes are fast to compute, hybrid attacks can quickly test a large number of combinations derived from common words. This technique balances efficiency and coverage, making it a preferred method for penetration testers aiming to recover passwords within a reasonable timeframe. It targets the human tendency to use predictable variations.

• ✓

  Using a rule-based attack with Hashcat, such as best64.rule, to mutate a wordlist.

  Why this is correct

  Rule-based attacks apply transformations to each word in a wordlist, such as appending numbers, capitalizing letters, or substituting characters. This significantly increases the effective search space without requiring a massive wordlist. In the context of NTLM hashes, which are unsalted and fast to compute, rule-based attacks are highly efficient for recovering passwords that are simple variations of common words. The best64.rule is a well-known set of rules that covers many common password patterns, making it a top choice for penetration testers.

• ✗

  Using a distributed cracking setup with multiple GPUs to increase hash rate.

  Why it's wrong here

  Distributed cracking with multiple GPUs increases the overall hash rate, allowing more guesses per second. While this can speed up any attack, it does not inherently improve the chances of recovering passwords; it only reduces the time required for a given attack. The effectiveness still depends on the attack strategy, such as dictionary or rule-based methods. Without a smart approach, simply adding GPUs may not yield better results. Therefore, it is not one of the most effective techniques for maximizing recovery; it is an optimization, not a strategy.

• ✗

  Performing a brute-force attack with a mask that covers all possible 8-character combinations.

  Why it's wrong here

  Brute-forcing all 8-character combinations is computationally intensive and often impractical, even with GPUs. While it can eventually find any password of that length, the time required is prohibitive for typical penetration test timeframes. NTLM hashes are fast to compute, but the sheer number of combinations (e.g., 95^8) is enormous. This approach is less effective than targeted dictionary or rule-based attacks, which focus on likely passwords. Therefore, it is not a recommended technique for maximizing recovery in a reasonable time.

• ✗

  Utilizing a precomputed rainbow table for NTLM hashes.

  Why it's wrong here

  Rainbow tables can crack NTLM hashes quickly if the password is in the table, but they require massive storage and are limited to the specific character set and length covered. They are also defeated by salting, but NTLM hashes are unsalted, so they are technically feasible. However, rainbow tables are less effective than modern dictionary and rule-based attacks because they cannot adapt to new password patterns and are often outdated. For maximizing recovery in a dynamic environment, rule-based attacks are superior.