A penetration tester is utilizing social media to gather information about employees at a company. The tester has created a list of popular words used in employee profiles. For which of the…

Exploit chaining refers to combining multiple vulnerabilities in sequence to escalate privileges or gain access, not using a wordlist for authentication attacks.

Session hijacking involves stealing or forging an authenticated session token after a user has already logged in, not guessing passwords.

A dictionary attack uses a predefined list of words, phrases, and patterns to attempt authentication rather than exhaustive character combinations. Building a custom wordlist from employee social media profiles (names, hobbies, pet names, company jargon) increases the probability of matching passwords that users choose from familiar personal context. This technique is a core component of credential auditing during a penetration test.

A Karma attack is a rogue wireless access point attack that exploits probe requests from Wi-Fi clients, unrelated to password wordlists.