312-50V13 practice question 3 of 35

In the context of password security, a simple dictionary attack involves loading a dictionary file (a text file full of dictionary words) into a…

Choose your answer, then check it against the explanation.

Domain Network and Perimeter Hacking

In the context of password security, a simple dictionary attack involves loading a dictionary file (a text file full of dictionary words) into a cracking application such as L0phtCrack or John the Ripper, and running it against user accounts located by the application. The larger the word and word fragment selection, the more effective the dictionary attack is. The brute force method is the most inclusive, although slow. It usually tries every possible letter and number combination in its automated exploration. If you would use both brute force and dictionary methods combined together to have variation of words, what would you call such an attack?

Answer options

Correct Answer:

Explanation

A hybrid attack is a password cracking methodology that combines a dictionary attack with a brute-force attack. This technique enhances a standard dictionary attack by systematically applying modifications to the words from the dictionary list. These modifications include adding numerical suffixes or prefixes, substituting characters with symbols (e.g., 'a' with '@'), and altering capitalization. This approach is significantly more effective than a simple dictionary attack against users who create passwords by slightly modifying common words (e.g., "Password123"), and it is much faster than a pure brute-force attack that tries every possible combination.

Why Incorrect

A. Full Blown: This is a descriptive phrase, not a recognized technical term for a specific password attack method in cybersecurity.

B. Thorough: This is a general adjective describing the comprehensiveness of an effort, not the name of a specific attack technique.

D. BruteDics: This is a fabricated, non-standard term. The correct industry and academic term is "hybrid attack."

References

1. Weir

Aggarwal

de Medeiros

& Glodek

M. (2009). Password cracking using probabilities

patterns

and permutations. In 2009 IEEE Symposium on Security and Privacy (pp. 35-49). IEEE. This paper discusses password cracking techniques

describing methods that apply "common permutations to dictionary words

such as appending a single digit

" which is the definition of a hybrid attack. (Section III.A). DOI: https://doi.org/10.1109/SP.2009.11

2. University of California

Berkeley. (2020). CS 161: Computer Security

Lecture 6: Web Security Model & Password Hashing. Course materials describe password cracking techniques

including dictionary attacks augmented with "rules" to append numbers or symbols

which is the essence of a hybrid attack. (Slide 53

"Guessing Passwords").

3. Hashcat Official Documentation. (n.d.). Attack modes. The documentation for Hashcat

a prominent password recovery tool covered in CEH

explicitly defines hybrid attack modes. For example

attack mode 6 is "Hybrid Wordlist + Mask

" and attack mode 7 is "Hybrid Mask + Wordlist

" demonstrating the combination of dictionary files and brute-force masks. (Section: hashcat --help

Attack modes).

Question 3 of 35

Keep practicing

Take the free 312-50V13 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test