An administrator has enabled salting for users' passwords on a UNIX box. A penetration tester must attempt to retrieve password hashes. Which of the following files must the penetration tester use…

Question

Options

• A/etc/passwd
• B/etc/shadow
• C/etc/security
• D/etc/password
• E/sbin/logon
• F/bin/bash

• A
  85% (40)
• D
  9% (4)
• E
  4% (2)
• F
  2% (1)

Explanation

In cryptography, a salt is random data that is used as an additional input to a one-way function that hashes a password or passphrase. In this question, enabling salting for users' passwords means to store the passwords in an encrypted format. Traditional Unix systems keep user account information, including one-way encrypted passwords, in a text file called /etc/passwd''. As this file is used by many tools (such as ls'') to display file ownerships, etc. by matching user id #'s with the user's names, the file needs to be world- readable. Consequentially, this can be somewhat of a security risk. Another method of storing account information is with the shadow password format. As with the traditional method, this method stores account information in the /etc/passwd file in a compatible format. However, the password is stored as a single "x" character (ie. not actually stored in this file). A second file, called ``/etc/shadow'', contains encrypted password as well as other information such as account or password expiration values, etc.

No community discussion yet for this question.