Define credential cracking and two common methods.

• A. Credential cracking is guessing/obtaining valid credentials; methods include brute force (dictionary) and credential stuffing (using breached credentials).
• B. Credential cracking is hashing passwords; methods include salting and peppering.
• C. Credential stuffing is illegal and not used in pentests.
• D. It is only about phishing.

Answer: (A)

Credential cracking is the process of obtaining valid login credentials so someone can access a system. Two common methods are brute force, often using a dictionary of likely passwords to speed things up, and credential stuffing, where leaked username/password pairs from breaches are tried on many sites or services to see where they work.

Brute force explores many possible passwords until one fits; using a dictionary makes this faster by focusing on words and common variations rather than random guesses. Credential stuffing leverages password reuse—attackers take known credentials from breaches and attempt them on other services, hoping users reuse the same passwords. This approach can be rapid and scalable because it exploits the real-world pattern that people often reuse passwords.

The other options describe password protection techniques (like hashing, salting, or peppering) or refer to phishing or other attack methods, which are different concepts from credential cracking itself.