Password attacks
Password attacks use credential guessing, credential stuffing, or brute force techniques against exposed authentication services to attempt to gain access. These attacks are among the most consistently effective initial access methods because they exploit human behavior rather than vulnerabilities.
Strategic context
Password attacks succeed because people choose predictable passwords, reuse passwords across services, and organizations often implement password policies that allow this behavior. A policy requiring eight characters with complexity still allows passwords like "Summer2025!" which appears in countless wordlists.
Password attacks are more successful when sufficient reconnaissance is conducted. Username enumeration, password policy discovery, and breach data analysis informs our targeting decisions.
For security leaders, password attacks show the limitations of password-based authentication as a standalone control. Multi-factor authentication, account lockout policies, and credential monitoring are the primary defenses.
Types of password attacks
Password spraying
Password spraying tests a small number of likely passwords against a large number of accounts. It is designed to avoid account lockout thresholds by limiting the number of attempts per account within a given time window.
This works because it only takes one user with a weak password to provide access. In a domain with hundreds or thousands of users, the odds are favorable.
nxc smb target -u users.txt -p 'Spring2025!'Common password candidates include seasonal passwords (Spring2025!), company name variations (CompanyName1!), or patterns revealed by breach data analysis.
Brute force
Brute force tests many passwords against a single account or service. It is noisier than spraying and more likely to trigger lockout, but appropriate when a specific account is targeted and the lockout policy is understood.
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target -t 4For web application login forms, Hydra needs to understand the form structure, including field names, request format, and failure indicators:
hydra -l admin -P wordlist.txt target http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"Credential stuffing
Credential stuffing uses credentials obtained from breach data against the target's authentication services. It exploits the tendency for people to use the same password across multiple services.
This technique requires breach data correlated with usernames identified during reconnaissance. When a match is found, the success rate is significantly higher than generic brute force.
Hash cracking
When password hashes are obtained through other means, offline cracking converts hashes to plaintext without interacting with the target.
Hash cracking matters during initial access when SQL injection or file inclusion provides access to a database containing hashed credentials needed for authentication to a different service.
Common mistakes
Launching brute force attacks without checking the account lockout policy
Using large generic wordlists when targeted wordlists would be more effective and faster
Ignoring breach data as a source of credentials
Testing credentials against a single service when they may be valid elsewhere
Operator notes
Always determine the lockout policy before automated password testing
Password spraying is generally preferable to brute force
Credential reuse is commonm and disovered credentials should always be tested against other accessible services
Last updated