To avoid triggering IDS/IPS alerts, the attacker should use offline cracking on compromised hashes rather than direct brute-force attempts.
Crack user accounts using compromised hashes (Option A):
Hashes can be cracked offline using tools like Hashcat or John the Ripper.
No direct login attempts, avoiding detection by security systems.
Reference: CompTIA PenTest+ PT0-003 Official Study Guide - "Password Cracking Techniques and Evasion" Incorrect options:
Option B (Brute force): Generates excessive failed logins, triggering IDS/IPS alerts.
Option C (SQL injection): Exploits database vulnerabilities, not direct account compromise.
Option D (XSS attack): Can steal cookies but does not directly compromise accounts.