312-50 Question 133
Single answer▪ Password CrackingDuring an authorized internal assessment, you obtain a copy of a Linux server's password hashes from /etc/shadow. The hashes use SHA-512 crypt with unique salts, and the client has asked you to determine whether weak employee passwords are in use as quickly as possible without generating additional network traffic. Which approach is the MOST effective first step for cracking these passwords?
- A
Perform an offline dictionary attack with rule-based mutations against the extracted hashes
- B
Launch an online password spraying attack against the SSH service using common passwords
- C
Use a rainbow table attack against the SHA-512 crypt hashes to recover passwords efficiently
- D
Run a network sniffer to capture cleartext credentials from employee workstations
Show answer and explanation
Correct answer: A
Explanation
When an assessor has already obtained password hashes, offline cracking is typically the most efficient and least disruptive next step. In this scenario, the hashes are SHA-512 crypt from /etc/shadow, which means they are salted and intentionally designed for password storage rather than fast hashing. Best practice is to begin with a dictionary-based attack enhanced by rules, because many weak enterprise passwords are variations of common words, seasons, company names, and predictable suffixes. This aligns with real-world password auditing methodology and with guidance reflected in common cracking tools such as John the Ripper and Hashcat, both of which support wordlist and rule-based attacks against Unix password hashes. Rainbow tables are not suitable against unique salts, and online attacks or network sniffing are less appropriate because they increase operational risk and do not satisfy the requirement to avoid additional network traffic.
- A. Correct.
Correct. Because the tester already has the password hashes, the fastest and most appropriate initial method is an offline attack using a wordlist plus rule-based mutations (such as capitalization, suffixes, and common character substitutions). This approach is effective for identifying weak user-chosen passwords while avoiding additional network traffic or account lockout risk. For salted SHA-512 crypt hashes, tools such as John the Ripper or Hashcat are commonly used in offline cracking workflows.
- B. Incorrect.
Incorrect. Password spraying targets live authentication services and generates network traffic, which the scenario specifically says to avoid. It also risks triggering account lockouts, detections, or rate limiting. Although spraying can be useful in some engagements, it is not the best first step when hashes have already been acquired for offline analysis.
- C. Incorrect.
Incorrect. Rainbow tables are generally impractical against properly salted hashes. SHA-512 crypt in /etc/shadow includes per-password salts, which largely defeats the precomputed-table advantage that rainbow tables rely on. Candidates may choose this option because rainbow tables are associated with password cracking, but they are not an effective first choice here.
- D. Incorrect.
Incorrect. Packet capture would create additional monitoring activity and is not relevant to cracking hashes already obtained from /etc/shadow. In addition, modern environments commonly use encrypted protocols such as SSH, meaning cleartext credentials are unlikely to be visible on the wire. This option reflects the misconception that sniffing is a universal credential recovery method.