PT0-002 · Question #447
A penetration tester uses Hashcat to crack hashes discovered during a penetration test and obtains the following output: ad09cd16529b5f5a40a3e15344e57649f4a43a267a97f008af01af803603c4c8: Summer2023…
The correct answer is B. Implementing a blocklist of known bad passwords. The penetration tester's discovery of passwords vulnerable to hash cracking suggests a lack of robust password policies within the organization. Among the options provided, implementing a blocklist of known bad passwords is the most effective immediate remediation. This measure…
Question
A penetration tester uses Hashcat to crack hashes discovered during a penetration test and obtains the following output:
ad09cd16529b5f5a40a3e15344e57649f4a43a267a97f008af01af803603c4c8:
Summer2023 !! 7945bb2bb08731fc8d57680ffa4aefec91c784d231de029c610b778eda5ef48b:
p@ssWord123 ea88ceab69cb2fb8bdcf9ef4df884af219fffbffab473ec13f20326dc6f84d13: Love- You999 Which of the following is the best way to remediate the penetration tester's discovery?
Options
- ARequiring passwords to follow complexity rules
- BImplementing a blocklist of known bad passwords
- CSetting the minimum password length to ten characters
- DEncrypting the passwords with a stronger algorithm
How the community answered
(43 responses)- A5% (2)
- B84% (36)
- C2% (1)
- D9% (4)
Explanation
The penetration tester's discovery of passwords vulnerable to hash cracking suggests a lack of robust password policies within the organization. Among the options provided, implementing a blocklist of known bad passwords is the most effective immediate remediation. This measure would prevent users from setting passwords that are easily guessable or commonly used, which are susceptible to hash cracking tools like Hashcat.
Topics
Community Discussion
No community discussion yet for this question.