Attacks and Exploits · Topic 2 of 10
Authentication Attacks
Tell apart brute force, password spraying, credential stuffing, pass-the-hash and Kerberos ticket attacks, with log indicators and defences for each.
- 5 min
- Brute force targets one account with many guesses, and spraying uses few guesses across many accounts.
- Credential stuffing reuses leaked pairs, and MFA is a key defence.
- Hashes are one-way, salts defeat rainbow tables, and slow hashing makes cracking costly.
What it is
Authentication attacks aim to prove an identity that does not belong to the attacker. They guess passwords, reuse stolen ones, or replay credential material such as hashes and tickets.
The exam expects you to recognise each attack from a short description, name a tool family, and pick the best defence. Credentials are the most common route into a network, so these questions appear often.
How it works
Online guessing attacks
These attacks send attempts to a live service, such as a login page, Secure Shell (SSH) or Remote Desktop Protocol (RDP).
| Attack | Idea | Key indicator |
|---|---|---|
| Brute force | Try many password combinations for an account | Many failures against one account |
| Dictionary | Try words from a list of likely passwords | Common passwords tried in order |
| Password spraying | Try one or a few common passwords across many accounts | One source, many accounts, few attempts each |
| Credential stuffing | Reuse leaked username and password pairs from other breaches | Many accounts tried, with valid pairs matching other sites |
Tools such as Hydra automate online guessing against many protocols. Account lockout stops simple brute force. Spraying is designed to stay below lockout thresholds, so defenders should look for the pattern across accounts and not only per account.
Credential stuffing works because many people reuse passwords. It is fought with multifactor authentication (MFA), checks of new passwords against breach lists, and rate limiting.
Offline cracking
Systems store password hashes, which are one-way transformations of passwords. If an attacker or tester obtains a hash file, cracking tools such as Hashcat and John the Ripper test guesses at high speed without touching the target.
| Term | Meaning |
|---|---|
| Hash | Fixed-size output of a one-way function |
| Salt | Random value added before hashing so identical passwords give different hashes |
| Rainbow table | Precomputed table of hashes, made useless by salting |
| Slow hash | Algorithms such as bcrypt or Argon2 that are deliberately costly to compute |
Defences are long passphrases, salted slow hashing and protecting hash stores.
A mask attack is a focused form of cracking. When the tester knows the likely pattern of a password, such as its length and which character type sits in each position, a mask describes that pattern so the tool tries only matching candidates. This shrinks the search space and speeds up cracking a predictable password.
Pass-the-hash and related replay attacks
In Windows environments using the NT LAN Manager (NTLM) protocol, a password hash can be used to authenticate directly. Pass-the-hash replays a captured hash without knowing the password.
Kerberos has similar ideas. Pass-the-ticket reuses a stolen ticket, and Kerberoasting requests service tickets for accounts with service names and cracks them offline. NTLM relay forwards an authentication attempt to another server instead of cracking anything.
| Attack | Material used | Defence |
|---|---|---|
| Pass-the-hash | NTLM hash | Disable NTLM where possible, protect credential memory, unique local administrator passwords |
| Pass-the-ticket | Kerberos ticket | Short ticket lifetimes, tiered administration |
| Kerberoasting | Service account ticket | Long random service account passwords, managed service accounts |
| NTLM relay | Live authentication exchange | Server Message Block (SMB) signing, disable NTLM, Extended Protection |
Local administrator password reuse across machines lets one stolen hash open many systems. Tools such as Local Administrator Password Solution (LAPS) give each machine a unique password.
Other authentication weaknesses
- Default credentials on devices and applications.
- MFA fatigue, where a user is flooded with approval prompts until one is accepted.
- Weak password reset or account recovery processes.
- Session tokens that can be stolen and reused.
- Services that allow guessable or missing authentication.
LDAP injection
Lightweight Directory Access Protocol (LDAP) injection happens when user input changes the meaning of a directory query, such as a login filter. The fixes are to escape input and use parameterised LDAP calls.
Federation attacks: OIDC and SAML
OpenID Connect (OIDC) and Security Assertion Markup Language (SAML) let one identity provider sign a user in to many services. At concept level the weaknesses are token or assertion theft and replay, forged or altered assertions, and weak validation of signatures, redirect addresses or the state and nonce values. The fixes are strict signature and assertion validation, checked redirect addresses, and one-time state and nonce values.
More tools
| Tool | Purpose |
|---|---|
| Responder | Captures NTLM hashes by poisoning name-resolution requests, feeding the relay and cracking attacks above |
| Medusa | A parallel online login-guessing tool, an alternative to Hydra |
Spotting these attacks in logs
On Windows, event 4625 records a failed logon and event 4624 a successful one. Many 4625 events from one source suggest guessing, and a successful logon after a long run of failures is a strong alert.
Kerberos events 4768 (ticket-granting ticket request) and 4769 (service ticket request) help detect ticket abuse. A burst of service ticket requests by one account is a Kerberoasting indicator.
Guessing attacks can lock out real users, so confirm lockout policies and the testing window before any credential testing.
What to remember for the exam
- Brute force targets one account with many guesses, and spraying uses few guesses across many accounts.
- Credential stuffing reuses leaked pairs, and MFA is a key defence.
- Hashes are one-way, salts defeat rainbow tables, and slow hashing makes cracking costly.
- Pass-the-hash replays an NTLM hash without the password.
- Kerberoasting targets service account tickets, and strong service passwords defend against it.
- NTLM relay forwards authentication, and SMB signing helps stop it.
- Windows events 4625 and 4624 show failed and successful logons.
- Hydra, Hashcat, John the Ripper and NetExec are tools in this area.
Common mistakes
Mixing up spraying and brute force. Spraying varies the account, and brute force varies the password.
Thinking lockout stops everything. It does not stop spraying or credential stuffing that stays under the limit.
Expecting salts to stop all cracking. Salts defeat precomputed tables, but a weak password can still be guessed.
Assuming pass-the-hash needs the password. The hash itself is the credential in NTLM.
Missing the log pattern. Failures spread across many accounts from one address are easy to overlook without correlation.
Check yourself
Which attack tries one common password against many accounts?
Password spraying.
Why does pass-the-hash work?
NTLM accepts the hash itself as proof of identity, so the password is not needed.
Which Windows event ID records a failed logon?
4625.
Topic 2 of 10 in Attacks and Exploits
Test yourself on Attacks and Exploits
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.