nerdexam
EC-Council

312-50V9 · Question #100

After gaining access to the password hashes used to protect access to a web based application, knowledge of which cryptographic algorithms would be useful to gain access to the application?

The correct answer is A. SHA1. When password hashes are obtained, knowing the specific hashing algorithm used allows an attacker to perform targeted brute-force or rainbow table attacks against those hashes.

Cryptography

Question

After gaining access to the password hashes used to protect access to a web based application, knowledge of which cryptographic algorithms would be useful to gain access to the application?

Options

  • ASHA1
  • BDiffie-Helman
  • CRSA
  • DAES

How the community answered

(55 responses)
  • A
    93% (51)
  • B
    2% (1)
  • C
    4% (2)
  • D
    2% (1)

Why each option

When password hashes are obtained, knowing the specific hashing algorithm used allows an attacker to perform targeted brute-force or rainbow table attacks against those hashes.

ASHA1Correct

SHA1 is a one-way hashing algorithm commonly used to store password digests. Knowing the target application uses SHA1 allows an attacker to precompute rainbow tables or run brute-force attacks generating SHA1 hashes to match against the stolen hashes, ultimately recovering plaintext passwords.

BDiffie-Helman

Diffie-Hellman is a key exchange protocol used to establish shared secrets, not a password hashing algorithm, so it would not be involved in protecting stored credentials.

CRSA

RSA is an asymmetric encryption algorithm used for digital signatures and key exchange, not for hashing or storing passwords.

DAES

AES is a symmetric encryption cipher, not a hashing function, and is not typically used to create password digests stored in web applications.

Concept tested: Password hash cracking using known hashing algorithms

Source: https://owasp.org/www-community/attacks/Password_Cracking

Topics

#SHA1#password hashing#hash cracking#web application security

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice