Dictionary · Hacking Techniques and Methodologies
Dictionary Attack
Identity attacks · Intermediate
Trying secrets from a list of likely words, phrases, and leaked passwords instead of every possible combination. It succeeds when people choose predictable secrets.
People pick passwords that have already been seen. A list of those choices is much smaller than every possible string. Password managers and unique secrets take away that advantage.
Example: An audit of a lab's stored hashes shows that several match common words. The accounts are reset and the policy rejects those words.
Common misconception
- A list of likely passwords is not an exhaustive search. It is effective because human choices are predictable.