How password attacks work

In this section, we're going to take a look at what password cracking is; it is also known as password testing. We will cover the different approaches we can take when doing password cracking and finally, we're going to learn about password policies and account locking, which is important when planning a password attack.

Password cracking

Password cracking is the most common type of brute force attack against web applications. It is an attack against the login credentials, and it exploits the fact that passwords are usually weak, due to the fact that users need to remember them and they need a difficult-to-guess word.

Password cracking is usually done with a dictionary of known words, or more exactly, with a list of well-known and widely used passwords. These lists are created by taking the most used passwords from the list of passwords leaked from different online services. Password lists may also include variations of words, such as those generated by replacing letters...