A county engagement obtains an NTLM-class hash within scope. Conceptually, which distinction should guide next steps?
Select an answer to reveal the explanation.
Short Explanation
A hash is like a stamped metal key blank: you can try to reverse-engineer the shape offline, or—in some protocols—present the stamp itself. Those are different plays with different rules. Know which class you’re in before you move.
Full Explanation
Captured authentication material may support offline password recovery attempts or protocol-level reuse depending on hash type, environment controls, and authorization. Offline cracking seeks candidate plaintext; pass-the-hash style techniques authenticate using the hash material without necessarily recovering the password. Testers must understand the class of action they are choosing, stay within RoE, and document evidence carefully. Conceptual clarity prevents unsafe or unauthorized follow-on activity framed as 'just cracking.'