Next Step After Capturing NTLMv2 Hashes with Responder
During the reconnaissance phase, a penetration tester runs the following command: sudo responder -I tun0 The result of the command is a list of NTLMv2 hashes. Which of the following should the penetration tester do next?
Community Votes
71% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the difference between NTLM hashes (usable for pass-the-hash) and NTLMv2 challenge-response hashes (must be cracked offline). The common trap is assuming all captured hashes can be used for pass-the-hash.
In CompTIA PenTest+ PT0-002, capturing NTLMv2 hashes with Responder during reconnaissance typically leads to cracking them with Hashcat, as these hashes cannot be directly used in pass-the-hash attacks.
Choosing C (pass the hash with CrackMapExec) is the most common mistake because testers often confuse NTLM hashes with NTLMv2 hashes. NTLMv2 includes a challenge-response component that prevents direct pass-the-hash reuse.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Responder captures NTLMv2 hashes, which are challenge-response based and cannot be directly replayed in a pass-the-hash attack. The recommended next step is to crack the hash offline using a tool like Hashcat, which can attempt to recover the plaintext password. This aligns with the typical penetration testing workflow: gather credentials, crack them, then use the recovered password for lateral movement or further attacks.Why the Other Options Are Wrong
Option C (pass the hash with CrackMapExec) is incorrect because NTLMv2 hashes require a challenge-response interaction; they cannot be used directly as NTLM hashes. Option B (collision attack) is irrelevant; hashcat cracking uses brute force or dictionary attacks, not cryptographic collisions. Option A (password spraying) is not the immediate next step; spraying is a separate attack that uses known passwords, not the harvested hash itself.Community Comment Notes
Comment [2] correctly explains why pass-the-hash fails for NTLMv2, a key technical distinction. Comment [1] argues for pass-the-hash first due to speed, but this is operationally risky and not the best exam answer because the hash type is not compatible. Comment [3] simply agrees with D, reflecting the majority consensus among test-takers.Official Reference
Exam Strategy
When a question mentions NTLMv2 hashes, remember that they need to be cracked first, not passed. Distinguish between NTLM and NTLMv2: NTLM can be used for pass-the-hash, while NTLMv2 requires offline cracking with Hashcat or John the Ripper.