Which technique uses a stolen or forged hash to gain access without decrypting the password?

Which technique uses a stolen or forged hash to gain access without decrypting the password?

• A. Pass-the-Hash Attack
• B. Brute Force Attack
• C. Replay Attack
• D. Keylogger Attack

Answer: (A)

This question is about credential theft and authentication bypass using hashed credentials. In a pass-the-hash attack, the attacker obtains a password hash from a compromised system (such as NTLM/LM hashes on Windows) and then presents that hash to a remote service to authenticate. Since the authentication process accepts the hash as proof of identity, the attacker can access systems and often move laterally without ever decrypting the actual password. This makes the hash the usable credential, not the plaintext password, which is why no decryption is needed. Brute force would involve guessing passwords to recover the plaintext, which is different because it tries to reveal the actual password rather than use a stolen hash directly. A replay attack would reuse a valid authentication message or token, but not specifically rely on presenting a password hash to gain access in the way pass-the-hash does. A keylogger captures keystrokes to obtain credentials, but that still requires later use of the captured plaintext and doesn’t exploit authentication via a stolen hash to access other systems.

This question is about credential theft and authentication bypass using hashed credentials. In a pass-the-hash attack, the attacker obtains a password hash from a compromised system (such as NTLM/LM hashes on Windows) and then presents that hash to a remote service to authenticate. Since the authentication process accepts the hash as proof of identity, the attacker can access systems and often move laterally without ever decrypting the actual password. This makes the hash the usable credential, not the plaintext password, which is why no decryption is needed.

Brute force would involve guessing passwords to recover the plaintext, which is different because it tries to reveal the actual password rather than use a stolen hash directly. A replay attack would reuse a valid authentication message or token, but not specifically rely on presenting a password hash to gain access in the way pass-the-hash does. A keylogger captures keystrokes to obtain credentials, but that still requires later use of the captured plaintext and doesn’t exploit authentication via a stolen hash to access other systems.