GCFA · Question #149
John, a novice web user, makes a new E-mail account and keeps his password as "apple", his favorite fruit. John's password is vulnerable to which of the following password cracking attacks? Each…
The correct answer is B. Brute Force attack C. Dictionary attack D. Hybrid attack. The password 'apple' is a short, common dictionary word with no complexity, making it vulnerable to any attack that does not require specific prior knowledge of the target's password habits.
Question
John, a novice web user, makes a new E-mail account and keeps his password as "apple", his favorite fruit. John's password is vulnerable to which of the following password cracking attacks? Each correct answer represents a complete solution. Choose all that apply.
Options
- ARule based attack
- BBrute Force attack
- CDictionary attack
- DHybrid attack
How the community answered
(61 responses)- A25% (15)
- B75% (46)
Why each option
The password 'apple' is a short, common dictionary word with no complexity, making it vulnerable to any attack that does not require specific prior knowledge of the target's password habits.
Rule-based attacks rely on prior intelligence about a specific target's known password patterns or organizational policies to generate customized guesses, which does not apply when the password is an arbitrary common word with no contextual link to any attacker-defined rule set.
Brute force attack tries every possible character combination systematically; 'apple' is only 5 lowercase letters, making it crackable in seconds with any brute force tool.
Dictionary attack uses a precompiled wordlist of common words and phrases; 'apple' is a standard English word present in virtually every dictionary attack wordlist.
Hybrid attack combines dictionary words with brute-force character mutations such as appending numbers or symbols; 'apple' would be matched as a pure dictionary hit before any mutation is needed.
Concept tested: Password strength and attack vector identification
Source: https://owasp.org/www-community/attacks/Password_Cracking
Topics
Community Discussion
No community discussion yet for this question.