nerdexam
GIAC

GCFA · Question #149

John, a novice web user, makes a new E-mail account and keeps his password as "apple", his favorite fruit. John's password is vulnerable to which of the following password cracking attacks? Each…

The correct answer is B. Brute Force attack C. Dictionary attack D. Hybrid attack. The password 'apple' is a short, common dictionary word with no complexity, making it vulnerable to any attack that does not require specific prior knowledge of the target's password habits.

Advanced Incident Response & Digital Forensics Fundamentals

Question

John, a novice web user, makes a new E-mail account and keeps his password as "apple", his favorite fruit. John's password is vulnerable to which of the following password cracking attacks? Each correct answer represents a complete solution. Choose all that apply.

Options

  • ARule based attack
  • BBrute Force attack
  • CDictionary attack
  • DHybrid attack

How the community answered

(61 responses)
  • A
    25% (15)
  • B
    75% (46)

Why each option

The password 'apple' is a short, common dictionary word with no complexity, making it vulnerable to any attack that does not require specific prior knowledge of the target's password habits.

ARule based attack

Rule-based attacks rely on prior intelligence about a specific target's known password patterns or organizational policies to generate customized guesses, which does not apply when the password is an arbitrary common word with no contextual link to any attacker-defined rule set.

BBrute Force attackCorrect

Brute force attack tries every possible character combination systematically; 'apple' is only 5 lowercase letters, making it crackable in seconds with any brute force tool.

CDictionary attackCorrect

Dictionary attack uses a precompiled wordlist of common words and phrases; 'apple' is a standard English word present in virtually every dictionary attack wordlist.

DHybrid attackCorrect

Hybrid attack combines dictionary words with brute-force character mutations such as appending numbers or symbols; 'apple' would be matched as a pure dictionary hit before any mutation is needed.

Concept tested: Password strength and attack vector identification

Source: https://owasp.org/www-community/attacks/Password_Cracking

Topics

#password cracking#dictionary attack#brute force#hybrid attack

Community Discussion

No community discussion yet for this question.

Full GCFA Practice