nerdexam
GIAC

GPEN · Question #192

John, a novice web user, makes a new E-mail account and keeps his password as "apple", his favorite fruit. John's password is vulnerable to which of the following password cracking attacks? Each…

The correct answer is A. Dictionary attack C. Hybrid attack D. Brute Force attack. The password 'apple' is a plain, common dictionary word with no modifications, making it susceptible to dictionary, hybrid, and brute-force attacks but not specifically rule-based attacks.

Exploitation & Post-Exploitation Techniques

Question

John, a novice web user, makes a new E-mail account and keeps his password as "apple", his favorite fruit. John's password is vulnerable to which of the following password cracking attacks? Each correct answer represents a complete solution. Choose all that apply.

Options

  • ADictionary attack
  • BRule based attack
  • CHybrid attack
  • DBrute Force attack

How the community answered

(37 responses)
  • A
    73% (27)
  • B
    27% (10)

Why each option

The password 'apple' is a plain, common dictionary word with no modifications, making it susceptible to dictionary, hybrid, and brute-force attacks but not specifically rule-based attacks.

ADictionary attackCorrect

Dictionary attacks try words from a precompiled wordlist; 'apple' is a common English word that would appear in virtually any standard dictionary wordlist, making it immediately crackable.

BRule based attack

Rule-based attacks apply predefined transformation rules (e.g., replacing 'a' with '@', appending numbers) to existing wordlist entries to crack modified passwords; 'apple' is an unmodified plain word that does not require rule-based mutation to discover.

CHybrid attackCorrect

A hybrid attack combines dictionary words with brute-force appending or prepending of characters; 'apple' as a base word is the starting point for hybrid attacks, meaning it is found at the zero-mutation stage.

DBrute Force attackCorrect

Brute-force attacks systematically try every possible character combination; 'apple' is only 5 lowercase characters, placing it well within the feasible range of a brute-force search.

Concept tested: Password cracking attack types and applicability

Source: https://owasp.org/www-community/attacks/Password_Cracking

Topics

#dictionary attack#hybrid attack#brute force#weak passwords

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice