312-50 Question 458
Single answer▪ Cryptography ToolsDuring an internal penetration test, you obtain access to a Linux web server and discover a file named backup.enc that the administrator says was encrypted with OpenSSL using AES-256-CBC and a password. You are authorized to assess whether the password is weak by attempting offline cracking. Which approach is the most appropriate for extracting crackable data from the file and testing it with a password-cracking tool?
- A
Use John the Ripper's openssl2john utility to extract the OpenSSL-encrypted file data, then run John the Ripper against the resulting hash representation.
- B
Use Hydra directly against backup.enc to brute-force the AES key because Hydra supports offline attacks against encrypted files.
- C
Import the file into Wireshark and inspect the TLS handshake to recover the password used by OpenSSL.
- D
Use Aircrack-ng to derive the passphrase because AES-256-CBC encryption is commonly used in wireless security.
Show answer and explanation
Correct answer: A
Explanation
The key skill being tested is selecting the correct cryptography tool for the job. In a real CEH-style scenario, once you confirm authorization for offline password auditing, the proper workflow is to extract a crackable representation from the OpenSSL-encrypted file and use an offline password-cracking tool that supports that format. John the Ripper commonly supports this through utilities such as openssl2john, which convert the encrypted file metadata into a format John can process. By contrast, Hydra is intended for online attacks against authentication services, Wireshark is for packet capture analysis rather than local file decryption, and Aircrack-ng is specialized for wireless key recovery. This aligns with practical penetration-testing methodology: identify the encryption format, use the correct extractor or converter, and then apply an authorized offline cracking tool. Tool usage should always be validated against the current John the Ripper jumbo documentation and OpenSSL file-format behavior in the target environment.
- A. Correct.
Correct. For password-protected files encrypted with OpenSSL, a standard offline assessment workflow is to use a format-conversion helper such as openssl2john to extract the relevant parameters into a representation John the Ripper can test. John can then attempt dictionary, rule-based, or brute-force attacks against the password-derived encryption material. This is the practical and tool-appropriate method for assessing weak passwords on OpenSSL-encrypted files.
- B. Incorrect.
Incorrect. Hydra is primarily an online password-guessing tool used against network services such as SSH, FTP, HTTP, RDP, and similar protocols. It is not the appropriate tool for offline cracking of an OpenSSL-encrypted file. A candidate might choose this because Hydra is well known for brute-forcing credentials, but its purpose is service authentication, not file-format-specific offline cryptanalysis.
- C. Incorrect.
Incorrect. Wireshark analyzes captured network traffic. A local encrypted file such as backup.enc does not involve a TLS handshake unless it was transmitted over the network and traffic was captured separately. Even then, inspecting a handshake would not directly reveal the file's password. This distractor targets the misconception that all OpenSSL use implies TLS packet analysis.
- D. Incorrect.
Incorrect. Aircrack-ng is designed for wireless network security assessment, especially WEP and WPA/WPA2-PSK cracking from captured 802.11 traffic. Although AES is used in some wireless contexts, Aircrack-ng is not the correct tool for attacking a generic OpenSSL-encrypted file. This option is plausible only because it mentions AES, but the use case is unrelated.