12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML

Password attacks on PT0-003 4.3 are about how you try secrets, not about writing a custom brute-force engine. CompTIA names dictionary, brute-force, mask, password spraying, and credential stuffing, then MFA fatigue, LDAP injection, OIDC attacks, and SAML attacks. The tools that implement those ideas are Hydra and Medusa (online), hashcat and John the Ripper (offline), Burp Suite (intercept and tamper federation messages), plus CME and Responder when a captured hash or a domain password is the input.

Five password-attack methods

Dictionary attacks try a wordlist of likely passwords: leaked corporate vocabulary, seasons, sports teams, keyboard walks. Speed comes from ranking, not from covering the entire keyspace.

Brute-force tries every combination in a character set and length range. Online, it is the fastest way to lock accounts and trip detections. Offline, it is feasible only for short or low-entropy secrets.

Mask attacks are constrained brute-force: you already know the pattern — eight characters, first uppercase, three letters, then a year. The mask shrinks the keyspace. Exam trap: calling every wordlist a mask, or calling a mask a dictionary.

Password spraying tries few passwords against many users so each account stays under the lockout threshold. Two seasonal passwords against the whole directory is spraying. Ten thousand guesses against one VIP is not.

Credential stuffing replays leaked username and password pairs from other breaches. The password is not guessed; the pair is reused because people recycle logins. Stuffing is not spraying. Spraying uses a small shared password list, not per-user breach pairs, and it is not a dictionary against a single admin.

Worked example: 10,000 users, lockout after 5

The directory has 10,000 users. Policy locks an account after 5 failures. Leadership wants the CEO's password recovered this afternoon. The 4.3 answer is not 10,000 guesses against the VIP. That account locks at attempt 5, the SOC sees a focused brute, and 9,995 of those guesses never happen. Spray two seasonal passwords — a season-year pattern and a company-name-plus-digit pattern — once each across the 10,000 users. Every account sees two failures, which is under the lockout of five. You cover the whole directory, you stay inside a typical rules-of-engagement lockout constraint, and you still have budget for a later targeted dictionary if spraying is clean.

That worked example is the exam's favorite discrimination: spraying is horizontal and lockout-aware; brute-force against one identity is vertical and noisy.

Online versus offline cracking

Online attacks hit a live authenticator: SSH, HTTPS login, SMB, FTP, RDP, a web form. Hydra and Medusa are the 4.3 online tools. They consume usernames plus a password list or a pair file and speak the protocol. Rules of engagement, lockout policy, and logging dominate the decision. Slow the rate. Stop on lockout. Do not point Hydra at an out-of-scope single sign-on portal.

Offline attacks hit a hash, not the live domain controller. hashcat (GPU) and John the Ripper consume NTLM hashes, Kerberoast tickets, AS-REP blobs, Linux shadow material, or other captured hashes and try dictionary, brute, or mask attacks without incrementing the domain lockout counter. Responder's captured challenge-response often becomes hashcat input. Kerberoasting from the previous section is an identification technique whose crack step is hashcat or John.

CME can authenticate with a password or a hash against many hosts — useful as a check after spraying, and a cousin of spraying when one password is tried domain-wide. It is still not a replacement for hashcat.

MFA fatigue: the human plus the protocol

MFA fatigue (prompt bombing, push spam) floods the user with push approval requests until the tired user taps Accept. The password may already be known from spraying, stuffing, or phishing. The second factor is a human protocol that can be worn down. CompTIA lists this as an authentication attack, not only as social engineering, because the authenticator protocol is being abused. Exam writers like that pairing: a human who is tired of taps, and a push protocol that offered a yes-or-no prompt instead of a phishing-resistant ceremony.

Defenses the exam wants: number matching (the user must type a number shown on the login screen into the app — a yes-or-no push is not enough) and phishing-resistant MFA (FIDO2, passkeys, hardware security keys, certificate-based authentication). Training users not to tap yes is weaker than changing the protocol. SMS one-time codes are not the fatigue pattern; fatigue is about push prompts. Exam trap: answering 'brute-force the six-digit TOTP' when the stem shows dozens of phone pushes.

LDAP injection

LDAP injection is the directory cousin of SQL injection. The application concatenates user input into an LDAP filter such as a uid-and-password conjunction. Metacharacters (wildcards, parentheses, boolean operators) can change the filter: bypass a password clause, match extra objects, or dump attributes the user interface should never return. Identification: intercept the login or search, see unsanitized input in the filter, and prove that filter logic changed. You do not need a warehouse of payloads. The exam wants this labeled as injection against the directory query, not a web SQL injection finding (that is objective 4.5) and not BloodHound (that graphs existing rights).

OIDC and SAML attacks

Federation protocols move identity as tokens (OIDC / OAuth 2.0) or assertions (SAML). Attacks on PT0-003 are conceptual:

• Token or assertion tampering: change subject, email, groups, or admin flags if the signature is not checked.
• Algorithm confusion: treating an HMAC secret as an RSA key, or accepting a none algorithm.
• Missing signature validation: the service trusts the JSON or XML because it looks like a login response.
• Audience or recipient mismatches: a token minted for app A is accepted by app B; a SAML assertion's Audience or Recipient does not match the service that honors it.

Burp Suite is the 4.3 intercept tool: capture the redirect, the identity token, or the SAML Response, inspect claims and signatures, and test whether the app notices a modified assertion in an authorized test. Do not treat Burp as a Kerberos ticket injector. Pass-the-token (previous section) reuses a valid stolen token. OIDC and SAML attacks here are about broken validation of the token or assertion.

free PenTest+ practice questionsPractice questions with detailed explanations