Hybrid Attack for Non-Dictionary Password Modifications

System Hacking

As a certified ethical hacker, you are performing a system hacking process for a company that is suspicious about its security system. You found that the company’s passwords are all known words, but not in the dictionary. You know that one employee always changes the password by just adding some numbers to the old password. Which attack is most likely to succeed in this scenario?

Brute-Force Attack
Password Spraying Attack
Hybrid Attack Correct Answer
Rule-based Attack

Answer Correct answer: C — A Hybrid Attack is most likely to succeed because it combines dictionary-based known words with systematic modifications like appending numbers.

Community Votes

58%

42%

58% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests your ability to distinguish between pure brute-force, hybrid, and rule-based attacks based on specific user behavior patterns, specifically the trap of assuming 'not in dictionary' excludes hybrid attacks.

This question explores password cracking techniques when passwords are known words but not found in standard dictionaries. The page establishes that a Hybrid Attack is the correct method because it combines dictionary words with suffix/prefix modifications like numbers.

Many candidates choose Rule-Based Attack (D) because the passwords are explicitly stated as 'not in the dictionary,' incorrectly assuming that hybrid attacks rely exclusively on exact dictionary matches without modification.

Community Discussion (17 comments)

agelbahri 👍 1 Selected: C

A Hybrid Attack can adapt and incorporate a range of possible modifications (like appending any number from 0–9999), which covers the broader password modification habits described in this scenario. This adaptability makes it the more suitable and successful approach here. In short, while Rule-Based Attacks are precise, Hybrid Attacks are more flexible and effective for cracking passwords with variable patterns

blehbleh 👍 1 Selected: D

Pretty sure this is D. It seems that individuals are over looking the fact that the words are not in the dictionary which is crazy because its literally stated in there. Therefore it should be D.

Binx 👍 1

if the password is explicitly stated as not being in the dictionary, a standard hybrid attack might not be as effective, because it relies on a combination of dictionary words and brute-force techniques. Given this scenario, the most appropriate answer would likely be: D. Rule-based Attack

7d8c2c7 👍 2

C. Hybrid Attack CEH v12 Page 604 ybrid Attack This type of attack depends on the dictionary attack. Often, people change their passwords merely by adding some numbers to their old passwords. In this case, the program would add some numbers and symbols to the words from the dictionary to try to crack the password. For example, if the old password is “system,” then there is a chance that the person will change it to “system1” or “system2.”

GK2205 👍 1 Selected: D

Attackers use rule-based attacks when they have some knowledge of the passwords and see evidence of simple salts and peppers like "123" at the end of the password. This question is garbage in terms of it's wording, but does combine the two fundamental concepts of rule-based.

g_man_rap 👍 1

D. Rule-based Attack Rule-based attacks are a sophisticated form of brute-force/dictionary attacks where the attacker defines complex rules based on typical user behavior of password creation (like replacing 'o' with '0', adding years at the end, etc.). This can be highly effective if you understand the common modifications users make to base words in their passwords.

qtygbapjpesdayazko 👍 1 Selected: C

C. Hybrid Attack Key word Often, people change their passwords merely by adding some numbers to their old passwords.

Labas01 👍 1 Selected: D

This is a more powerful attack than disctionary and brute-force attacks because the cracker knows the password type." (M06 P604)

dobarb 👍 2

Is C. Hybrid attack, as the first comment says, at page 604 of CEH there is clearly written this attack works when people changes the password by just adding some numbers to the old password.

qtygbapjpesdayazko 👍 1 Selected: C

D. Rule-based Attack

athicalacker 👍 2 Selected: D

The question mentions the words are not in the dictionary. So it can't be hybrid since it utilizes dictionary of known words.

LeongCC 👍 1 Selected: C

C: Hybrid Attack

sosindi 👍 1 Selected: C

Hybrid Attack

insaniunt 👍 3 Selected: C

Hybrid Attack: This type of attack depends on the dictionary attack. Often, people change their passwords merely by adding some numbers to their old passwords. In this case, the program would add some numbers and symbols to the words from the dictionary to try to crack the password. For example, if the old password is “system,” then there is a chance that the person will change it to “system1” or “system2

Unr34l 👍 2

C. Hybrid Attack A hybrid attack combines elements of both dictionary attacks (known words) and brute-force attacks (trying all possible combinations, including modifications like adding numbers). In this case, the attacker leverages the knowledge that the passwords are known words but also incorporates variations by adding numbers. Hybrid attacks are effective in situations where there are patterns or rules applied to password creation, as is the case in the described scenario.

JustAName 👍 3 Selected: D

I think answer is D, because it specify "known words, but NOT dictionary". Hybrid attack combined with known words from dictionary, so rule-based should be a more accurate answer.

cloudgangster 👍 3 Selected: C

C check pg 604 CEH V12

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

A Hybrid Attack combines elements of both dictionary attacks and brute-force attacks. In this scenario, the attacker knows the base password is a 'known word' but observes a pattern where users append numbers. The hybrid attack will take dictionary words (the known words) and systematically append variations (numbers) to them, effectively covering the 'system1', 'system2' style changes even if the base word isn't in the current target dictionary list, or by using a general wordlist. As noted in CEH v12 study materials, this specific behavior of adding numbers to old passwords is the textbook definition for why a Hybrid Attack is most likely to succeed.

Why the Other Options Are Wrong

Brute-Force (A) tries every possible combination, which is inefficient and unlikely to succeed quickly against complex alphanumeric strings compared to targeted methods. Password Spraying (B) involves trying one common password across many accounts, which does not fit the scenario of cracking specific individual passwords. Rule-Based (D) is a strong distractor; while it uses rules, the CEH curriculum specifically categorizes the 'dictionary + number appending' scenario under Hybrid Attacks in the context of this exam's logic.

Community Comment Notes

The community split between C and D. Many learners, such as 'insaniunt', cited Page 604 of the CEH v12 guide stating that hybrid attacks handle cases where people add numbers to passwords. Others like 'JustAName' argued for D because the words aren't in the dictionary, but the official stance prioritizes the hybrid nature of combining a wordbase with numeric brute-forcing.

Exam Strategy

When you see keywords like 'adding numbers to words' or 'mixing dictionary and brute force,' immediately think of a Hybrid Attack. Do not let the phrase 'not in the dictionary' distract you from the fact that the base structure is still a known word pattern, which is the core of a hybrid approach in CEH terminology.

Frequently Asked Questions

Why is Hybrid Attack correct if words are not in the dictionary?

CEH defines Hybrid as mixing dictionary words with brute-force variations. Even if the specific modified password isn't in a static list, the attack engine generates these variants from a base wordlist.

When should I choose Rule-Based over Hybrid Attack?

Choose Rule-Based when specific complex patterns (like Leet speak substitutions) are known. Choose Hybrid for simple structural changes like appending numbers or dates to base words.

More 312-50v12 FAQ →

Related Analysis

← Back to 312-50v12 Study Guide