Pass the Hash is a technique used to authenticate using what?

• A. A captured NTLM hash without knowing the plaintext password
• B. A one-time password
• C. A public key
• D. A cryptographic nonce

Answer: (A)

Pass the Hash relies on using a Windows NTLM credential directly as proof of identity. If an attacker captures the NTLM hash, they can present that hash to a target service and be authenticated as that user without ever knowing the plaintext password. The authentication handshake accepts the hash as the credential, so possession of the hash equals access to resources that accept NTLM authentication, enabling lateral movement and resource access. This isn’t about a one-time password, public-key cryptography, or a nonce used for anti-replay; it’s about using the captured hash itself as the credential.