The environment contains no Windows hosts (so Windows-specific credential-capture tools like Responder are ineffective). The tester needs credentials on non-Windows servers (likely SSH). The SOC only monitors endpoints (not servers), meaning aggressive credential guessing against servers may go unnoticed. hydra is a parallelized remote-auth brute-force tool that targets services such as SSH and can iterate a username list (-L) and password list (-P) across multiple targets (-M). This makes option D the most direct tool to attempt credential discovery on non-Windows hosts (SSH brute-force).
Why not the others:
A: pwinspector is Windows-focused/unknown in this context.
B: responder targets LLMNR/NetBIOS broadcasts on Windows networks — not applicable.
C: nmap will enumerate services (helpful), but it does not obtain credentials.
PT0-003 mapping: Domain 3 — post-compromise credential discovery and use of appropriate tools given OS/service mix.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit