Which attack uses a user-mode SSPI to obtain the NetNTLM response within the context of the logged-on user?

Which attack uses a user-mode SSPI to obtain the NetNTLM response within the context of the logged-on user?

• A. Dictionary Attack
• B. Internal Monologue Attack
• C. FOR loop
• D. Hybrid Attack

Answer: (B)

This question is about credential harvesting through Windows SSPI in the context of the current user session. NTLM authentication uses a challenge/response mechanism, and the NetNTLM response is the value the client sends back in that exchange. If an attacker can run code in the same logged-on user’s context, they can access that NetNTLM response from memory via the user-mode Security Support Provider Interface (SSPI). This allows the attacker to use or crack the response without having to capture network traffic or guess the password themselves. That specific technique—feeding on the legitimate SSPI calls inside the user’s process to obtain the NetNTLM response—is what the Internal Monologue Attack describes. The other options refer to password-guessing techniques rather than methods to extract the NetNTLM response from the current user session, so they don’t fit this scenario.

This question is about credential harvesting through Windows SSPI in the context of the current user session. NTLM authentication uses a challenge/response mechanism, and the NetNTLM response is the value the client sends back in that exchange. If an attacker can run code in the same logged-on user’s context, they can access that NetNTLM response from memory via the user-mode Security Support Provider Interface (SSPI). This allows the attacker to use or crack the response without having to capture network traffic or guess the password themselves. That specific technique—feeding on the legitimate SSPI calls inside the user’s process to obtain the NetNTLM response—is what the Internal Monologue Attack describes.

The other options refer to password-guessing techniques rather than methods to extract the NetNTLM response from the current user session, so they don’t fit this scenario.