A penetration tester is trying to gain access to a remote system. The tester is able to see the secure login page and knows one user account and email address, but has not yet discovered a password…

The correct answer is C. Social engineering. When a penetration tester already knows a target's username and email address, social engineering is the path of least resistance. The tester can craft a convincing phishing email, impersonate IT helpdesk, or use pretexting to manipulate the user into revealing their password…

Enterprise Security Operations

Question

A penetration tester is trying to gain access to a remote system. The tester is able to see the secure login page and knows one user account and email address, but has not yet discovered a password. Which of the following would be the EASIEST method of obtaining a password for the known account?

Options

AMan-in-the-middle
BReverse engineering
CSocial engineering
DHash cracking

How the community answered

(43 responses)

B
2% (1)
C
93% (40)
D
5% (2)

Explanation

When a penetration tester already knows a target's username and email address, social engineering is the path of least resistance. The tester can craft a convincing phishing email, impersonate IT helpdesk, or use pretexting to manipulate the user into revealing their password - requiring minimal technical skill and no prior access to system internals. Option A (MitM) requires being positioned between the client and server in the network path, which demands more setup. Option B (reverse engineering) requires access to the application binary and significant time. Option D (hash cracking) requires first obtaining password hashes from the system, which the tester doesn't have yet. Social engineering bypasses technical defenses entirely.

Topics

#social engineering#penetration testing#credential attacks#password acquisition

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice