Pass-the-Hash Attacks Explained: Lateral Movement for CompTIA Security+ and PenTest+
Pass-the-hash (PtH) is one of the most durable attacks in Windows environments, and it shows up on both CompTIA Security+ (SY0-701) and CompTIA PenTest+ (PT0-003) for the same reason: it's simple, it still works against misconfigured networks today, and it explains why a single compromised workstation can turn into domain-wide compromise in minutes. This guide covers how the attack actually works, how attackers and penetration testers carry it out in practice, how defenders detect it, and the mitigations that genuinely stop it — including correcting a myth that gets repeated often: password salting does not protect against pass-the-hash. What Is Pass-the-Hash? Windows authentication over NTLM doesn't send a password across the network. Instead, the client proves it knows the password by using a hash of that password (the NT hash) to compute a response to a server-issued challenge. That design choice is also the vulnerability: since the hash itself is what gets used to aut...