GPEN Password Attacks and Formats Practice Question
You are performing an offline attack against a password hash stored in an NTDS.dit file. You have successfully dumped the hashes using secretsdump.py. Given the format 'Username:RID:LMHash:NTHash:::', which hash should be targeted for a modern Windows environment to maximize cracking efficiency?
⚠ Common exam trap
Test-takers frequently focus on legacy LM hashes or duplicate empty fields, forgetting that modern Windows environments exclusively rely on NTLM authentication and NTHashes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NTHash, because it is the primary hash used by NTLM authentication.
Modern Windows systems prioritize NTLM authentication, which relies on the NTHash. The LM hash is deprecated, weak, and often stored as a null value or a fixed constant in modern systems. Targeting the NTHash allows for pass-the-hash attacks or brute-force attempts that align with the underlying authentication protocol. Understanding the structure of these hashes is crucial for penetration testers to select the correct dictionary or mask attack strategies during local account auditing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The LMHash, because it is shorter and faster to calculate.
Why it's wrong here
LM hashes are severely flawed due to their case-insensitive nature and splitting the password into two seven-character blocks. Modern Windows systems disable LM hashes by default, making them unreliable for modern penetration testing scenarios where NTLM is the standard for secure password credential storage and transmission.
- ✗
The RID, because it provides the unique identifier for the account.
Why it's wrong here
The Relative Identifier (RID) is part of the Security Identifier (SID) used for access control and permissions, not for password validation. Cracking a RID does not yield the plaintext password, as it is a constant value associated with account creation order rather than a cryptographic representation of secret data.
- ✓
The NTHash, because it is the primary hash used by NTLM authentication.
Why this is correct
The NTHash is a MD4 hash of the Unicode representation of the plaintext password. Since Windows Vista, NTLM has become the standard authentication protocol. Targeting the NTHash allows for direct pass-the-hash exploitation without needing the plaintext, making it the most effective target for modern penetration testing engagements.
- ✗
The entire string, including the colons, to ensure format integrity.
Why it's wrong here
Including metadata like the RID and empty fields in a cracking attempt will cause the hash cracking software to fail or misidentify the hash type. Password cracking tools require only the specific cryptographic hash component to perform computations, as extraneous data interferes with the underlying algorithm implementation logic.
About these practice questions
This GPEN question is part of Courseiva's 298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GPEN practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GPEN exam.