nerdexam
GIAC

GCIH · Question #162

Which of the following attacks capture the secret value like a hash and reuse it later to gain access to a system without ever decrypting or decoding the hash?

The correct answer is B. Replay attack. A replay attack - specifically pass-the-hash - captures a hashed credential and presents it directly to an authentication service to gain access, entirely bypassing the need to crack or decode the hash. The hash itself acts as the authenticator.

Vulnerability Exploitation & Privilege Escalation

Question

Which of the following attacks capture the secret value like a hash and reuse it later to gain access to a system without ever decrypting or decoding the hash?

Options

  • ACross Site Scripting attack
  • BReplay attack
  • CRainbow attack
  • DHashing attack

How the community answered

(31 responses)
  • A
    3% (1)
  • B
    87% (27)
  • C
    3% (1)
  • D
    6% (2)

Why each option

A replay attack - specifically pass-the-hash - captures a hashed credential and presents it directly to an authentication service to gain access, entirely bypassing the need to crack or decode the hash. The hash itself acts as the authenticator.

ACross Site Scripting attack

Cross-Site Scripting injects malicious client-side scripts into web pages to steal session cookies or user data, and does not involve capturing or replaying credential hashes for system authentication.

BReplay attackCorrect

A replay attack, particularly in the pass-the-hash variant, intercepts a credential hash from network traffic or system memory and replays it to an authentication service such as NTLM, granting access without ever reversing or decoding the hash value.

CRainbow attack

A rainbow attack uses precomputed hash-to-plaintext lookup tables to reverse (crack) a hash back to its original password, which is the opposite of reusing a hash without decoding it.

DHashing attack

Hashing attack is not a defined or recognized attack category and does not describe any technique for capturing and replaying credential hashes to bypass authentication.

Concept tested: Pass-the-hash replay attack credential reuse

Source: https://attack.mitre.org/techniques/T1550/002/

Topics

#replay attack#hash reuse#credential theft#authentication bypass

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice