What is the recommended practice when handling password hashes during a pentest to avoid impacting the target system?

• A. Crack the hashes directly on the target system to speed testing.
• B. Delete the hashes after capture to avoid storage.
• C. Share the hashes with the target organization to get approval.
• D. Move the hashes to the attacker's machine and crack there, ensuring originals are not modified.

Answer: (D)

Handling password hashes during a pentest should be done offline on a dedicated workstation to avoid affecting the target system. Cracking hashes on the target host uses its CPU and I/O, which can degrade performance, cause outages, or trigger security alarms, and it risks altering the system state or complicating incident handling. By moving the hashes to your own machine and cracking them there, you keep the target environment pristine, reduce the risk of disruption, and maintain a clear audit trail. It also ensures the originals remain unmodified on the target, preserving evidence and chain of custody while you perform analysis in a controlled, repeatable manner.