Which tool is well known for sniffing NTLM credentials on a Windows network and can crack hashes?

• A. Wireshark
• B. Nmap
• C. Cain & Abel
• D. Burp Suite

Answer: (C)

NTLM credentials on a Windows network can be captured and cracked using specialized tools; Cain & Abel stands out as it combines network sniffing of credentials with hash cracking capabilities. It can perform ARP poisoning to place itself on the same network segment and capture NTLM handshake traffic, which often includes NTLM hashes. Once captured, those hashes can be cracked using built-in password-cracking features, making it possible to recover plaintext passwords. This dual capability—intercepting credentials from traffic and then cracking the hashes—makes Cain & Abel particularly well known for this purpose.

Wireshark, while excellent for capturing and analyzing network traffic, doesn't include hash cracking features; you’d need separate tools to crack anything you capture. Nmap is a network discovery and vulnerability scanning tool, not designed to sniff credentials or crack hashes. Burp Suite focuses on web application security testing and does not target Windows network NTLM sniffing or crack NTLM hashes.