Password Attacks and Defenses

What is it?

Password attacks attempt to gain unauthorized access by guessing or recovering credentials. Brute force tries every possible combination systematically. Dictionary attacks try a curated list of common or leaked passwords first, which is far faster because most people don’t choose truly random passwords. Both are only legitimate when performed within an authorized engagement’s scope, typically against a test account, never a real production account without explicit permission.

Why should I learn it?

Testers are asked to assess authentication strength constantly, and understanding why an attack works is what leads to the correct defensive recommendation — not just “tell users to pick better passwords.”

How it works

An attacker (or authorized tester) has a target login form or a set of stolen password hashes → a brute force or dictionary approach systematically tries candidates → success depends heavily on how the password was stored: a properly hashed and salted password takes vastly longer to crack than one stored in plaintext or with a weak, unsalted hash. The real defense operates at multiple layers: hashing with a strong, slow algorithm (so stolen data is expensive to crack), salting (so identical passwords don’t produce identical hashes, defeating precomputed lookup tables), rate limiting/lockout (so online guessing is throttled), and MFA (so a correctly guessed password alone still isn’t enough).

Real-world example

Two companies suffer an identical database breach exposing password hashes. One used strong salted hashing — cracking is impractically slow. The other stored weak, unsalted hashes — most passwords are cracked within hours using a dictionary list of commonly leaked passwords. The breach was the same; the outcome wasn’t.

Troubleshooting mindset

If an assessment finds weak password policy, don’t stop at “require longer passwords” — check whether MFA and proper hashing are also in place, since password strength alone is only one layer of a much larger defense.

Common mistake

Do not memorise the definition without connecting it to real engagement practice. Ask: what does this concept mean for what I’m allowed to actually do, and how would I prove I stayed within scope?

Quick recap

• Understand the job of the phase or technique.
• Know where it sits in the overall testing methodology.
• Always tie it back to authorization and scope.
• Connect the topic to the next phase of the engagement.

Interview connection

Explain the concept in simple words first, then connect it to real engagement practice. That is stronger than repeating a tool name.

References & Further Reading

• AddySec original content — written for the Ethical Hacking track to build practical, interview-ready understanding.