nerdexam
GIAC

GCIH · Question #838

For what purpose would an auditor obtain a copy of the /etc/passwd file for a password audit of a linux machine?

The correct answer is C. The file allows for user enumeration prior to password cracking. On modern Linux systems, /etc/passwd does not store password hashes but does list all user accounts, making it the primary resource for user enumeration before conducting a password audit.

Reconnaissance, Scanning, and Enumeration

Question

For what purpose would an auditor obtain a copy of the /etc/passwd file for a password audit of a linux machine?

Options

  • AThe file contains hashes for rainbow tables cracking
  • BThe file is required for a dictionary guessing approach
  • CThe file allows for user enumeration prior to password cracking
  • DThe file allows for a brute force audit approach

How the community answered

(23 responses)
  • B
    4% (1)
  • C
    96% (22)

Why each option

On modern Linux systems, /etc/passwd does not store password hashes but does list all user accounts, making it the primary resource for user enumeration before conducting a password audit.

AThe file contains hashes for rainbow tables cracking

Modern Linux systems store password hashes in /etc/shadow, not /etc/passwd - the password field in /etc/passwd is replaced with an 'x' placeholder, so there are no hashes available for rainbow table attacks.

BThe file is required for a dictionary guessing approach

A dictionary guessing approach targets password hashes found in /etc/shadow, not in /etc/passwd, which contains no crackable credential data.

CThe file allows for user enumeration prior to password crackingCorrect

The /etc/passwd file contains one entry per user account including the username, UID, GID, home directory, and shell. Auditors use this file to enumerate all valid accounts on the system so that subsequent password cracking or auditing efforts are correctly targeted at real accounts. Without this enumeration step, an auditor would not know which usernames to test.

DThe file allows for a brute force audit approach

Brute force attacks similarly require password hashes from /etc/shadow to operate against, not the account metadata stored in /etc/passwd.

Concept tested: Linux /etc/passwd role in user enumeration

Source: https://man7.org/linux/man-pages/man5/passwd.5.html

Topics

#/etc/passwd#user enumeration#password audit#Linux reconnaissance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice