Dictionary Attack

Overview

A dictionary attack uses lists of common passwords, words, leaked credentials, patterns, names, and predictable variations to guess a secret efficiently. It may operate online against a login or offline against stolen password hashes or encrypted material.

Attackers improve success through language-specific lists, personal information, mutation rules, and password reuse. Offline attacks can test guesses rapidly unless strong salted password-hashing or key-derivation functions deliberately increase time and memory cost.

Defenses include long unique passwords, password managers, multifactor authentication, breached-password screening, rate limits, salts, and modern password hashing. Complexity rules that create predictable substitutions may offer less protection than encouraging genuinely long, unique credentials. Monitoring should distinguish distributed attempts from legitimate mistakes.

Dictionary Attack is an attack or weakness pattern that tests likely passwords, phrases, or keys from curated wordlists instead of exhaustively trying every possible combination. Dictionary attacks exploit human password patterns, making unique length, secure hashing, rate controls, and multifactor authentication more effective than predictable complexity.

Assessment of Dictionary Attack should trace an attack or weakness pattern that tests likely passwords, phrases, or keys from curated wordlists instead of exhaustively trying every possible combination from prerequisite and entry point through observable impact on the affected service. A theoretical weakness or scanner result involving attack, weakness pattern that tests likely passwords, and phrases should not be reported as exploitation without corroborating logs, transactions, or configuration evidence. Prevention, detection, containment, and recovery for the Dictionary attack path should be tested against the architecture associated with attack, weakness pattern that tests likely passwords, and phrases.

Retesting for Dictionary Attack should reproduce the Dictionary attack path involving attack, weakness pattern that tests likely passwords, and phrases, examine adjacent paths, and verify the conditions for safely returning the affected service to normal operation.