CoreQ Academy4.3 Given a scenario, perform authentication attacks using the appropriate tools.
Authentication attacks target passwords, hashes, tickets and tokens. Each technique maps to a specific defence that testers recommend.
Attack types
- Multifactor authentication (MFA) fatigue
- Flooding a user with push prompts until they approve. Defence: number matching and rate limits.
- Pass-the-hash attacks
- Using an NTLM hash to authenticate without the password. Defence: disable NTLM where possible, LAPS, privileged access tiers.
- Pass-the-ticket attacks
- Reusing stolen Kerberos tickets.
- Pass-the-token attacks
- Reusing stolen access or session tokens (e.g. cloud tokens). Defence: token binding, short lifetimes.
- Kerberos attacks
- Kerberoasting service tickets, AS-REP roasting and forged tickets. Defence: strong service account passwords or managed service accounts.
- Lightweight Directory Access Protocol (LDAP) injection
- Injecting into LDAP queries to bypass login or extract data.
- Dictionary attacks
- Trying words from a list of likely passwords.
- Brute-force attacks
- Trying every combination.
- Mask attacks
- Brute force constrained by a known pattern (e.g. Capital + 6 letters + 2 digits).
- Password spraying
- A few common passwords across many accounts to avoid lockout.
- Credential stuffing
- Using breached username/password pairs from other sites.
- OpenID Connect (OIDC) attacks
- Abusing flawed OIDC implementations: weak redirect URI validation, token leakage, missing state/nonce checks.
- Security Assertion Markup Language (SAML) attacks
- Tampering with SAML assertions, signature wrapping or accepting unsigned assertions.
Tools
- CME
- Validates credentials and sprays across Windows hosts.
- Responder
- Captures hashes from poisoned name resolution.
- hashcat
- GPU-accelerated offline password cracker.
- John the Ripper
- Versatile offline password cracker.
- Hydra
- Online brute force and spraying against network services.
- BloodHound
- Shows which credentials lead to which privileges.
- Medusa
- Parallel online login brute-forcer.
- Burp Suite
- Web proxy for testing login flows, tokens, OIDC and SAML.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.3 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.