PT0-002 · Question #330
A penetration tester learned that when users request password resets, help desk analysts change users' passwords to 123change. The penetration tester decides to brute force an internet-facing…
The correct answer is C. Password spraying. Password spraying is a technique where an attacker tests a common password (in this case, 123change) against many different usernames. This approach aims to avoid account lockout mechanisms that trigger when multiple incorrect passwords are tried in rapid succession on the same…
Question
A penetration tester learned that when users request password resets, help desk analysts change users' passwords to 123change. The penetration tester decides to brute force an internet-facing webmail to check which users are still using the temporary password. The tester configures the brute-force tool to test usernames found on a text file and the password 123change. Which of the following techniques is the penetration tester using?
Options
- ABrute-force attack
- BLDAP injection
- CPassword spraying
- DKerberoasting
How the community answered
(30 responses)- A3% (1)
- B3% (1)
- C87% (26)
- D7% (2)
Explanation
Password spraying is a technique where an attacker tests a common password (in this case, 123change) against many different usernames. This approach aims to avoid account lockout mechanisms that trigger when multiple incorrect passwords are tried in rapid succession on the same account. Instead, it tries the same password across many accounts to identify any users who are using the default or commonly known password.
Topics
Community Discussion
No community discussion yet for this question.