Which technique uses a stolen or forged hash to gain access without decrypting the password?

Which technique uses a stolen or forged hash to gain access without decrypting the password?

• A. Pass-the-Hash Attack
• B. Brute Force Attack
• C. Replay Attack
• D. Keylogger Attack

Answer: (A)

The main concept here is using hashed credentials to authenticate without decrypting the password. In a pass-the-hash attack, an attacker who has obtained a valid hash (for example, an NTLM hash) presents that hash to a service to log in as the user, without ever needing to know or decrypt the actual password. The authentication system checks the hash against what’s stored and, if it matches and the user has permissions, grants access. Because the attacker isn’t deciphering the plaintext password, the attack succeeds by abusing the credential itself rather than by breaking encryption. This differs from brute force, which attempts to recover the password by guessing it; and from a keylogger, which captures what a user types; and from a replay attack, which reposits a previously captured valid session or token. Pass-the-hash specifically exploits the ability to use the hashed credential as proof of identity. Mitigations include disabling or restricting the use of NTLM, adopting Kerberos wherever possible, enforcing multi-factor authentication, and monitoring for unusual authentication patterns across hosts and services.

The main concept here is using hashed credentials to authenticate without decrypting the password. In a pass-the-hash attack, an attacker who has obtained a valid hash (for example, an NTLM hash) presents that hash to a service to log in as the user, without ever needing to know or decrypt the actual password. The authentication system checks the hash against what’s stored and, if it matches and the user has permissions, grants access. Because the attacker isn’t deciphering the plaintext password, the attack succeeds by abusing the credential itself rather than by breaking encryption.

This differs from brute force, which attempts to recover the password by guessing it; and from a keylogger, which captures what a user types; and from a replay attack, which reposits a previously captured valid session or token. Pass-the-hash specifically exploits the ability to use the hashed credential as proof of identity. Mitigations include disabling or restricting the use of NTLM, adopting Kerberos wherever possible, enforcing multi-factor authentication, and monitoring for unusual authentication patterns across hosts and services.