A penetration tester obtains network-level access to a hardened subnet that has no Windows- based hosts and needs to find credentials. The client mentioned that the SOC is only monitoring user…

The correct answer is D. hydra -L root -P /path/to/wordlist -t 3 -M <file of targets>. The environment contains no Windows hosts (so Windows-specific credential-capture tools like Responder are ineffective). The tester needs credentials on non-Windows servers (likely SSH). The SOC only monitors endpoints (not servers), meaning aggressive credential guessing…

Submitted by takeshi77· Mar 6, 2026Attacks and Exploits

Question

A penetration tester obtains network-level access to a hardened subnet that has no Windows- based hosts and needs to find credentials. The client mentioned that the SOC is only monitoring user endpoints and not servers. Which of the following commands should the tester use?

Options

Apwinspector -i <file_of_targets> -o <found_credentials> -m 8 -M 16 -1 -u -n -p
Bresponder -I eth0
Cnmap -sV -n -T3 -p 22 <targets> --reason
Dhydra -L root -P /path/to/wordlist -t 3 -M <file of targets>

How the community answered

(26 responses)

A
4% (1)
B
4% (1)
C
12% (3)
D
81% (21)

Explanation

The environment contains no Windows hosts (so Windows-specific credential-capture tools like Responder are ineffective). The tester needs credentials on non-Windows servers (likely SSH). The SOC only monitors endpoints (not servers), meaning aggressive credential guessing against servers may go unnoticed. hydra is a parallelized remote-auth brute-force tool that targets services such as SSH and can iterate a username list (-L) and password list (-P) across multiple targets (-M). This makes option D the most direct tool to attempt credential discovery on non- Windows hosts (SSH brute-force).

Topics

#credential brute-forcing#password cracking#Hydra#network attacks

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice