Password Attacks
This attack uses fake messages or websites to trick someone into revealing a password.
What is phishing?
An attacker takes a leaked email-and-password pair from one website and tries it on several others.
What is credential stuffing?
This TryHackMe tool automates online password guessing against services such as SSH and web login forms.
What is Hydra?
This security process checks whether a person trying to sign in is who they claim to be.
What is authentication?
This consumer genetics company was involved in the October 2023 credential-stuffing incident discussed in the briefing.
What is 23andMe?
This software records the keys typed on a device and can capture passwords along with other private information.
What is a keylogger?
Someone receives a customized email that appears to be from their boss, urging them to open a fake company login page.
What is spear phishing?
In the command `hydra -l molly -P passwords.txt MACHINE_IP ssh`, what does the lowercase `-l` specify?
The single username to try.
A website returns different responses for unknown users and real users. An attacker uses that difference to discover valid account names.
What is username enumeration?
Following the 23andMe incident, the company introduced this additional sign-in verification step for new users, according to the slides.
What is two-step verification (two-factor authentication)?
This attack intercepts communication between two parties and may alter the messages they exchange.
What is a man-in-the-middle (MITM) attack?
A program tests every possible character combination in a password field rather than relying on a list of common words.
What is an exhaustive brute-force attack?
In a Hydra command, what does uppercase `-P passwords.txt` tell the program to use?
A file containing candidate passwords (a password wordlist).
After finding a valid username, an attacker automatically tries many passwords against its login form. Which lab attack does this demonstrate?
What is a brute-force attack?
What simple password habit helps prevent credential stuffing from working across different websites?
Using a different, unique password for every account.
This attack compares stolen password hashes with precomputed hash data to look for matches.
What is a rainbow table attack?
A hacker intercepts and potentially changes messages traveling between two computers without either side realizing.
What is a man-in-the-middle (MITM) attack?
In `hydra -l molly -P passwords.txt MACHINE_IP -t 4 ssh`, what is controlled by `-t 4`?
Four concurrent tasks / threads.
A password-reset workflow incorrectly trusts information the user can modify, allowing a reset to apply to a different account. What class of weakness is this?
What is a logic flaw?
What practice adds a unique random value to a password before it is hashed, making precomputed rainbow-table lookups ineffective?
What is salting?
Unlike exhaustive brute force, this attack tries a prepared collection of likely passwords, such as common words and leaked candidates.
What is a dictionary attack?
A database of password hashes is stolen. The attacker attempts to recover passwords through precomputed hash lookups, without repeatedly submitting guesses to the login page.
What is a rainbow table attack?
In a Hydra `http-post-form` command, why might the configuration include `F=incorrect`?
It tells Hydra which server response text indicates a failed login.
A site treats an editable browser cookie claiming `admin=true` as sufficient proof of administrator access. What lab technique could exploit that mistake?
What is cookie tampering?
The briefing says roughly 14,000 23andMe accounts were directly accessed, yet information connected to around 6.9 million users was exposed. Why were those numbers so different?
The accessed accounts exposed information about additional users linked to those accounts.