Password Attacks

1. Introduction to Password Attacks

A password attack is an attempt to discover, guess, obtain,
reuse or otherwise compromise a password or password-protected account.

Password attacks are important in cybersecurity because passwords are still
widely used to protect applications, email accounts, cloud services, servers,
databases and other systems.

2. Passwords and Authentication

A password is an authentication factor based on something the user knows.

Authentication determines whether a person or system should be allowed to
access a protected resource.

Authentication factors can include:

• Something you know
• Something you have
• Something you are

Passwords belong to the first category.

3. Passwords and Passphrases

A password may be short or long, while a passphrase usually
uses a longer sequence of words or characters.

Longer authentication secrets can provide a larger search space when they are
properly chosen and are not predictable.

Users should avoid predictable information such as names, birthdays, company
names or common phrases.

4. Password Reuse

Password reuse occurs when the same password is used across multiple
accounts.

This creates a major security problem because compromise of one service may
allow attackers to attempt access to other services using the same
credentials.

A unique password should be used for each important account.

5. Brute-Force Attacks

A brute-force attack attempts possible password combinations
systematically until a valid password is found.

The theoretical search space depends on the password’s length, character set
and other properties.

Defensive controls such as strong passwords, rate limiting, account
protections and MFA can make brute-force attempts significantly less useful.

6. Dictionary Attacks

A dictionary attack attempts passwords from a prepared
collection of likely words and combinations.

Dictionary attacks can be effective against predictable passwords based on
common words, names or patterns.

Users should avoid easily guessed words and predictable substitutions.

7. Hybrid Password Guessing

Attackers may combine dictionary words with common patterns, numbers or
symbols when attempting to guess weak passwords.

For example, replacing a letter with a predictable number does not
automatically make a password strong.

8. Password Spraying

Password spraying attempts a small number of commonly used
passwords against many accounts instead of trying many passwords against one
account.

This approach may attempt to avoid triggering protections designed only for
repeated failures against a single account.

Defensive controls include strong password policies, MFA, monitoring and
detection of unusual authentication patterns.

9. Credential Stuffing

Credential stuffing uses previously exposed username and
password combinations against other services.

It relies heavily on password reuse.

Unique passwords significantly reduce the likelihood that a breach at one
service will directly compromise another account.

10. Password Spraying vs Credential Stuffing

11. Offline Password Cracking

An offline password attack occurs when an attacker obtains
password hashes or another representation of credentials and attempts to
recover the original passwords without repeatedly interacting with the live
authentication service.

Offline attacks can be dangerous because online controls such as login rate
limits may not apply to the stolen data.

This is one reason secure password storage is essential.

12. Password Hashing

A password should generally not be stored as plain text.

Instead, applications should use a password-hashing function designed for
password storage.

Password hashing is different from ordinary data hashing because password
storage functions are designed to be computationally expensive and resistant
to common guessing attacks.

13. Salting

A salt is additional random data incorporated into password
hashing.

Salting helps ensure that identical passwords do not automatically produce
identical stored hashes when properly implemented.

Modern password-hashing functions can manage salts automatically.

14. Password Hashing Algorithms

Modern applications should use password-specific functions such as the
algorithms supported by PHP’s password_hash() API.

Developers should avoid inventing their own password-hashing system.

The appropriate algorithm and configuration should be selected according to
the application’s requirements and current security guidance.

15. Why Plain-Text Password Storage Is Dangerous

If an application stores passwords as plain text and the database is
compromised, attackers may immediately obtain the users’ passwords.

Because users sometimes reuse passwords elsewhere, the damage can extend
beyond the compromised application.

16. Rate Limiting

Rate limiting restricts how frequently authentication
attempts can be made.

It can reduce the effectiveness of repeated online password guesses.

Rate limiting should be designed carefully so that legitimate users are not
unreasonably prevented from accessing their accounts.

17. Account Lockout

Account lockout can temporarily block an account after repeated failed
authentication attempts.

However, aggressive lockout policies can themselves create availability
problems if attackers intentionally trigger failed logins against legitimate
accounts.

Organizations should balance security with usability and availability.

18. Multi-Factor Authentication

Multi-factor authentication (MFA) requires multiple
authentication factors.

MFA can reduce the impact of password compromise because knowing the password
alone may not be sufficient to complete authentication.

Where available, organizations should consider strong and phishing-resistant
authentication methods for sensitive systems.

19. Password Managers

A password manager can help users generate and store unique passwords for
different services.

This reduces the need for users to memorize many complex passwords and can
help reduce password reuse.

The password manager itself must be protected with a strong authentication
method.

20. Secure Password Policy

A useful password policy should focus on meaningful security outcomes rather
than simply requiring arbitrary complexity rules.

Organizations should consider:

• Minimum appropriate password length
• Blocking known compromised passwords
• Preventing password reuse where appropriate
• MFA for important accounts
• Secure password storage
• Rate limiting
• Monitoring suspicious authentication activity

21. Breached Passwords

A password that has appeared in a known data breach should not be reused.

Organizations may use approved password-screening mechanisms to prevent users
from selecting known compromised passwords.

Security teams should protect any password-screening process from becoming
another source of sensitive information.

22. Password Reset Security

Password-reset systems are important because attackers may attempt to exploit
weak recovery procedures instead of attacking the password directly.

Secure recovery should verify identity appropriately and avoid exposing
sensitive account information.

23. Security Questions

Traditional security questions can be weak when their answers are publicly
known or easy to guess.

Organizations should avoid relying on easily discoverable personal information
as the primary protection for sensitive account recovery.

24. Password Attacks and Phishing

Password attacks and phishing can work together.

Phishing may be used to obtain a password, while stolen credentials may later
be used in password-based attacks against other services.

This demonstrates why password security and user awareness must work
together.

25. Password Attacks and Malware

Some forms of malware may attempt to obtain credentials stored on or entered
into a device.

Endpoint protection, software updates, least privilege and secure
authentication practices can reduce related risks.

26. Administrative Accounts

Privileged accounts require additional protection because their compromise
may have a larger impact.

Organizations should minimize the number of privileged accounts and apply
strong authentication and monitoring.

27. Service Accounts

Service accounts may be used by applications or automated processes.

They should not automatically receive excessive privileges.

Organizations should review service-account credentials, permissions,
rotation procedures and usage.

28. Detecting Password Attacks

Security teams can monitor authentication events for unusual patterns.

Possible indicators include:

• Large numbers of failed login attempts
• Repeated failures across many accounts
• Successful login after many failures
• Authentication from unusual locations
• Unexpected privileged-account activity
• Impossible-travel or abnormal access patterns
• Repeated password-reset requests

These indicators should be evaluated in context because legitimate users can
also generate failed login events.

29. Password Security in Web Applications

Web applications should never compare plain-text passwords directly against
plain-text values stored in a database.

Instead, the application should use secure password-hashing and verification
functions.

30. PHP Example — Secure Password Hashing

PHP provides password-specific functions for securely hashing and verifying
passwords.

<?php

$password = 'Example-Strong-Passphrase';

$hash = password_hash(
	$password,
	PASSWORD_DEFAULT
);

if ( password_verify( $password, $hash ) ) {
	echo 'Password verification successful.';
} else {
	echo 'Password verification failed.';
}

The example demonstrates password hashing and verification only. It does not
perform password cracking or attempt unauthorized authentication.

31. Checking Whether a Hash Needs Updating

Password hashing algorithms and recommended parameters can change over time.
PHP provides password_needs_rehash() so applications can
determine whether an existing password hash should be replaced after a
successful login.

<?php

if (
	password_needs_rehash(
		$stored_hash,
		PASSWORD_DEFAULT
	)
) {

	$new_hash = password_hash(
		$password,
		PASSWORD_DEFAULT
	);

	// Store $new_hash securely.
}

32. Defensive Authentication Design

A secure authentication system should consider:

• Strong password hashing
• MFA
• Rate limiting
• Secure password reset
• Session protection
• Monitoring
• Least privilege
• Secure logging
• Compromised-password detection

33. Authorized Password Security Laboratory

Students can build a small local application that demonstrates secure
password hashing.

The exercise should:

1. Create a synthetic user.
2. Generate a password hash.
3. Store the hash locally.
4. Verify the password using password_verify().
5. Test an incorrect password.
6. Observe that the plain password is not stored in the database.

34. Password Attack Scenario

Imagine that an organization discovers repeated login failures against many
employee accounts from a small number of network sources.

The security team should investigate whether the pattern represents normal
activity, password spraying, credential stuffing or another cause.

Possible defensive actions may include:

• Review authentication logs.
• Check affected accounts.
• Look for successful logins following failures.
• Require password changes where appropriate.
• Strengthen MFA enforcement.
• Block or rate-limit suspicious sources where justified.
• Check whether compromised credentials are being reused.

35. Password Attack Prevention Checklist

36. Review Questions

1. What is a password attack?
2. What is the difference between a password and a passphrase?
3. What is a brute-force attack?
4. What is a dictionary attack?
5. What is password spraying?
6. What is credential stuffing?
7. Why is password reuse dangerous?
8. What is password hashing?
9. What is a salt?
10. Why should passwords not be stored as plain text?
11. What is rate limiting?
12. What are the advantages and limitations of account lockout?
13. How does MFA reduce password-related risk?
14. How can password managers improve security?
15. Why are compromised passwords dangerous?
16. Why do privileged accounts require additional protection?
17. How can security teams detect password attacks?
18. Why should password testing in a laboratory use synthetic credentials?

37. Key Takeaways

• Password attacks attempt to guess, obtain, reuse or compromise credentials.
• Brute force systematically attempts possible combinations.
• Dictionary attacks use likely words and common patterns.
• Password spraying targets many accounts with a small number of guesses.
• Credential stuffing reuses previously exposed credentials.
• Password reuse increases the impact of credential compromise.
• Passwords should be stored using appropriate password-hashing functions.
• Salting helps protect password hashes from several forms of precomputed attack.
• Rate limiting can reduce repeated online authentication attempts.
• MFA provides additional protection when passwords are compromised.
• Password managers can help users maintain unique credentials.
• Privileged accounts require stronger controls and monitoring.
• Authentication logs can help security teams identify suspicious patterns.
• Password security testing must be authorized.
• PHP provides password_hash() and password_verify() for password handling.

38. Conclusion

Password security is a combination of strong authentication design, secure
storage, user awareness, monitoring and appropriate access controls.

Understanding brute force, dictionary attacks, password spraying, credential
stuffing and offline attacks helps cybersecurity professionals recognize the
different ways credentials may be targeted.

The next lesson will examine what happens when attackers successfully obtain
or abuse credentials:
Account Compromise.