nerdexam
GIAC

GPEN · Question #432

192.168.116.9 Is an IP address forvvww.scanned-server.com. Why are the results from the two scans, shown below, different?

The correct answer is C. John.rec. John the Ripper's .rec file stores session checkpoint state, and its presence causes resumed sessions to produce different output than a fresh run.

Exploitation & Post-Exploitation Techniques

Question

192.168.116.9 Is an IP address forvvww.scanned-server.com. Why are the results from the two scans, shown below, different?

Exhibit

GPEN question #432 exhibit

Options

  • AJohn.pot
  • BJohn conf
  • CJohn.rec
  • DJohn.ini

How the community answered

(44 responses)
  • A
    5% (2)
  • B
    5% (2)
  • C
    77% (34)
  • D
    14% (6)

Why each option

John the Ripper's .rec file stores session checkpoint state, and its presence causes resumed sessions to produce different output than a fresh run.

AJohn.pot

john.pot is the output file where successfully cracked password hashes are stored, not a session state or progress tracker.

BJohn conf

john.conf is the configuration file defining rules, wordlists, and modes, and does not affect session resume behavior.

CJohn.recCorrect

The john.rec file is John the Ripper's restore file, recording the exact position within a cracking session when it was interrupted or paused. When a second run encounters an existing john.rec, it resumes from that checkpoint instead of starting from the beginning, which explains why the two scans of the same target yield different results.

DJohn.ini

john.ini is not a recognized standard John the Ripper file and plays no role in session management or scan state.

Concept tested: John the Ripper session restore file and cracking state

Source: https://www.openwall.com/john/doc/OPTIONS.shtml

Topics

#John the Ripper#password cracking#restore file#tool configuration

Community Discussion

No community discussion yet for this question.

Full GPEN Practice