Study guide
12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
Key Takeaways Explain This Topic AI
Dictionary tries a ranked wordlist; brute-force covers a full keyspace; a mask constrains that keyspace to a known pattern; spraying tries few passwords against many users to stay under lockout; stuffing replays leaked username and password pairs.
Worked 4.3 discrimination: 10,000 users and lockout after 5 failures means spray two seasonal passwords across the directory, not 10,000 guesses against one VIP account.
Hydra and Medusa are online against live logins; hashcat and John the Ripper are offline against captured hashes; Responder feeds hashes; CME checks a password or hash against many hosts.
MFA fatigue spams push prompts until the user accepts; exam-ready defenses are number matching and phishing-resistant MFA such as FIDO2 or hardware keys.
LDAP injection is SQL-injection-like tampering of directory filters; OIDC and SAML attacks are token or assertion tampering, algorithm confusion, missing signature validation, and audience or recipient mismatches, with Burp Suite as the intercept tool.
Last updated: August 2026
Password attacks on PT0-003 4.3 are about how you try secrets, not about writing a custom brute-force engine. CompTIA names dictionary , brute-force , mask , password spraying , and credential stuffing , then MFA fatigue , LDAP injection , OIDC attacks , and SAML attacks . The tools that implement those ideas are Hydra and Medusa (online), hashcat and John the Ripper (offline), Burp Suite (intercept and tamper federation messages), plus CME and Responder when a captured hash or a domain password is the input.
Five password-attack methods
Dictionary attacks try a wordlist of likely passwords: leaked corporate vocabulary, seasons, sports teams, keyboard walks. Speed comes from ranking, not from covering the entire keyspace.
Brute-force tries every combination in a character set and length range. Online, it is the fastest way to lock accounts and trip detections. Offline, it is feasible only for short or low-entropy secrets.
Mask attacks are constrained brute-force: you already know the pattern — eight characters, first uppercase, three letters, then a year. The mask shrinks the keyspace. Exam trap: calling every wordlist a mask, or calling a mask a dictionary.
Password spraying tries few passwords against many users so each account stays under the lockout threshold. Two seasonal passwords against the whole directory is spraying. Ten thousand guesses against one VIP is not.
Credential stuffing replays leaked username and password pairs from other breaches. The password is not guessed; the pair is reused because people recycle logins. Stuffing is not spraying. Spraying uses a small shared password list, not per-user breach pairs, and it is not a dictionary against a single admin.
Method What you try Lockout and detection profile Exam trap
Dictionary Ranked wordlist against one or many targets Online rate still counts toward lockout Calling hashcat a dictionary protocol
Brute-force Full keyspace Worst online: lockout and SOC noise Brute-forcing one VIP 10,000 times
Mask Keyspace limited by a known pattern Smaller than full brute Treating a single seasonal password as a mask definition
Password spraying Few passwords times many users Stays under per-account lockout Confusing with stuffing
Credential stuffing Leaked username and password pairs Follows the breach list, not a season word Calling any reused password stuffing
Worked example: 10,000 users, lockout after 5
The directory has 10,000 users . Policy locks an account after 5 failures . Leadership wants the CEO's password recovered this afternoon. The 4.3 answer is not 10,000 guesses against the VIP. That account locks at attempt 5, the SOC sees a focused brute, and 9,995 of those guesses never happen. Spray two seasonal passwords — a season-year pattern and a company-name-plus-digit pattern — once each across the 10,000 users. Every account sees two failures, which is under the lockout of five. You cover the whole directory, you stay inside a typical rules-of-engagement lockout constraint, and you still have budget for a later targeted dictionary if spraying is clean.
That worked example is the exam's favorite discrimination: spraying is horizontal and lockout-aware; brute-force against one identity is vertical and noisy.
Online versus offline cracking
Online attacks hit a live authenticator: SSH, HTTPS login, SMB, FTP, RDP, a web form. Hydra and Medusa are the 4.3 online tools. They consume usernames plus a password list or a pair file and speak the protocol. Rules of engagement, lockout policy, and logging dominate the decision. Slow the rate. Stop on lockout. Do not point Hydra at an out-of-scope single sign-on portal.
Offline attacks hit a hash, not the live domain controller. hashcat (GPU) and John the Ripper consume NTLM hashes, Kerberoast tickets, AS-REP blobs, Linux shadow material, or other captured hashes and try dictionary, brute, or mask attacks without incrementing the domain lockout counter. Responder's captured challenge-response often becomes hashcat input. Kerberoasting from the previous section is an identification technique whose crack step is hashcat or John.
CME can authenticate with a password or a hash against many hosts — useful as a check after spraying, and a cousin of spraying when one password is tried domain-wide. It is still not a replacement for hashcat.
MFA fatigue: the human plus the protocol
MFA fatigue (prompt bombing, push spam) floods the user with push approval requests until the tired user taps Accept. The password may already be known from spraying, stuffing, or phishing. The second factor is a human protocol that can be worn down. CompTIA lists this as an authentication attack, not only as social engineering, because the authenticator protocol is being abused. Exam writers like that pairing: a human who is tired of taps, and a push protocol that offered a yes-or-no prompt instead of a phishing-resistant ceremony.
Defenses the exam wants: number matching (the user must type a number shown on the login screen into the app — a yes-or-no push is not enough) and phishing-resistant MFA (FIDO2, passkeys, hardware security keys, certificate-based authentication). Training users not to tap yes is weaker than changing the protocol. SMS one-time codes are not the fatigue pattern; fatigue is about push prompts. Exam trap: answering 'brute-force the six-digit TOTP' when the stem shows dozens of phone pushes.
LDAP injection
LDAP injection is the directory cousin of SQL injection. The application concatenates user input into an LDAP filter such as a uid-and-password conjunction. Metacharacters (wildcards, parentheses, boolean operators) can change the filter: bypass a password clause, match extra objects, or dump attributes the user interface should never return. Identification: intercept the login or search, see unsanitized input in the filter, and prove that filter logic changed. You do not need a warehouse of payloads. The exam wants this labeled as injection against the directory query, not a web SQL injection finding (that is objective 4.5) and not BloodHound (that graphs existing rights).
OIDC and SAML attacks
Federation protocols move identity as tokens (OIDC / OAuth 2.0) or assertions (SAML). Attacks on PT0-003 are conceptual:
Token or assertion tampering : change subject, email, groups, or admin flags if the signature is not checked.
Algorithm confusion : treating an HMAC secret as an RSA key, or accepting a none algorithm.
Missing signature validation : the service trusts the JSON or XML because it looks like a login response.
Audience or recipient mismatches : a token minted for app A is accepted by app B; a SAML assertion's Audience or Recipient does not match the service that honors it.
Burp Suite is the 4.3 intercept tool: capture the redirect, the identity token, or the SAML Response, inspect claims and signatures, and test whether the app notices a modified assertion in an authorized test. Do not treat Burp as a Kerberos ticket injector. Pass-the-token (previous section) reuses a valid stolen token. OIDC and SAML attacks here are about broken validation of the token or assertion.
- Tool Role on 4.3 Consumes or intercepts
- Hydra, Medusa Online password attacks Usernames and password lists against live services
- hashcat, John the Ripper Offline cracking Hashes, Kerberoast and AS-REP material
- Responder Capture NTLM challenge-response on the wire
- CME Authentication check or spray-style reuse Passwords or NTLM hashes against many hosts
- BloodHound Priority, not scanning Which account is valuable to attack next
- Burp Suite Intercept HTTP, OIDC tokens, SAML assertions
When you finish 4.3, you should be able to name the attack from the credential type: hash reuse, ticket reuse, token reuse, roast, forge-after-compromise, dictionary, brute, mask, spray, stuffing, push fatigue, LDAP filter injection, or broken federation validation. Drill those identifications on the free PenTest+ practice questions before you sit PT0-003.