A pentester must attempt to crack passwords on a windows domain that enforces strong complex passwords. Which of the following would crack the MOST passwords in the shortest time period?

Online password testing is rate-limited by network latency and account lockout policies enforced on Windows domains, making it extremely slow and unlikely to succeed.

Windows domain controllers store passwords as unsalted NTLM hashes, which are highly vulnerable to rainbow table attacks because precomputed tables can map any hash back to its plaintext in seconds. This approach avoids the computational cost of repeated hashing that brute force requires, making it the fastest method against large sets of complex Windows passwords.

Dictionary attacks rely on common words and variations, which would fail against enforced complex passwords that include mixed case, numbers, and special characters not found in standard wordlists.

Brute force attacks must compute every possible combination on the fly, making them computationally impractical in a short time period against long, complex passwords.