CompTIA PenTest+ Practice Test

What is a primary characteristic of credential stuffing attacks?

1. Use of password hash strings

2. Reusing stolen username and password pairs

3. Leveraging public Wi-Fi vulnerabilities

4. Targeting single-session logins only

The correct answer is: Reusing stolen username and password pairs

Credential stuffing attacks primarily involve the reuse of stolen username and password pairs. Attackers obtain large lists of compromised credentials, typically from previous data breaches, and then use automated tools to try these credentials across multiple services. This tactic exploits the common behavior of users who often use the same login details across different accounts. By leveraging these stolen credentials, attackers can gain unauthorized access to user accounts on various platforms, taking advantage of the fact that many users do not change passwords even after a breach. This makes credential stuffing a significant threat in the cybersecurity landscape, as it relies on the poor password hygiene of users rather than exploiting specific vulnerabilities in the target system. The other choices do not accurately represent the primary characteristic of credential stuffing attacks. The use of password hash strings relates to how passwords are stored securely, leveraging public Wi-Fi vulnerabilities pertains to different types of attacks targeting unsecured networks, and targeting single-session logins only limits the scope by focusing on a less common access scenario, which does not align with the broad, scalable nature of credential stuffing.