Rule-based vs Hybrid Attack for Password Modification Patterns
As a certified ethical hacker, you are performing a system hacking process for a company that is suspicious about its security system. You found that the company’s passwords are all known words, but not in the dictionary. You know that one employee always changes the password by just adding some numbers to the old password. Which attack is most likely to succeed in this scenario?
Community Votes
80% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests the ability to differentiate attack types based on password structure; the common trap is confusing 'hybrid' with 'rule-based' when specific transformation rules are identified.
This question examines the distinction between rule-based and hybrid attacks when targeting passwords that follow predictable modification patterns. The correct answer is D, as rule-based attacks specifically utilize defined rules to generate variations of known words.
Learners often select C (Hybrid Attack) because it combines dictionary and brute-force methods, failing to recognize that the specific pattern described is a classic example of a rule-based application.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The scenario describes passwords that are known words modified by adding numbers. This is a textbook example of a Rule-based Attack (D). Rule-based attacks use specific rules or patterns (such as appending numbers, leet speak substitutions, or capitalization) to modify base dictionary words. Since the attacker knows the employee's specific behavior (adding numbers), they can apply this rule efficiently.Why the Other Options Are Wrong
Brute-Force (A) tries all possible character combinations, which is inefficient for long passwords. Password Spraying (B) involves trying one common password across many accounts, not cracking a specific account's complex password. Hybrid Attacks (C) combine dictionary attacks with brute-force techniques but are generally broader; while they can include rules, the specific exploitation of a known pattern like 'word + numbers' is best categorized under rule-based logic in certification contexts.Community Comment Notes
Many users voted for C, assuming that combining dictionary and modification constitutes a hybrid attack. As marcel9999 noted, "This type of attack depends on the dictionary attack," highlighting the confusion. However, Dogeo correctly identified that "slight modifications" point to efficiency, though they chose C. A dissenting voice, ehsarx, argued for D, stating "Rule based attack is sophisticated by the use of patterns," which aligns with the official doctrine for this specific scenario.Exam Strategy
When you see 'predictable patterns' or 'known modifications' applied to dictionary words, prioritize Rule-based Attacks over generic Brute-force or broad Hybrid definitions. Look for keywords like 'rules,' 'patterns,' or 'specific behaviors.'
Frequently Asked Questions
Why isn't this a Hybrid Attack?
Hybrid attacks broadly combine dictionary and brute-force methods. Rule-based attacks are more specific, applying defined transformation rules to dictionary words, which fits the 'adding numbers' pattern perfectly.
What distinguishes Rule-based from Brute-Force here?
Brute-force tries every combination blindly. Rule-based uses intelligence about the user's habits (e.g., 'add 123') to generate only plausible candidates, making it faster and more targeted.