How Did They Get the Password?

About this interactive

The lesson's ways passwords are hacked: - **Stolen as typed or sent:** phishing pages that collect it, eavesdropping on a session sent in clear text, an on-path device relaying the login, a keylogger recording keystrokes. - **Guessed at the login:** brute force (many passwords against one account), password spraying (one common password against many accounts), dictionary words, and a person's own details: names, birth dates, addresses, family. - **Reused from another breach:** credential stuffing tries leaked username and password pairs from one site on another, which is why every account needs its own password. - **Looked up from a stolen hash:** a rainbow table is a precomputed lookup of hashes, used to recover passwords from a stolen hash file.

What you'll learn

Tell how an attacker got or tried to get a password: stolen as it was typed or sent, guessed at the login, reused from another site's breach, or looked up from a stolen hash
Connect each route to the lesson's techniques: phishing, eavesdropping, on-path and keyloggers; brute force, spraying, dictionaries and personal details; credential stuffing; rainbow tables

Aligned to

CompTIA Network+

4.2 Summarize various types of attacks and their impact to the network.

Cisco CCST Cybersecurity

1.3 Explain access management principles.

Cisco CCNA

5.4 Describe security password policy elements.

Key terms

Brute Force Attack: An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
Password Spraying: An attack that attempts a single commonly used password against many different user accounts before moving to the next password, deliberately staying below account lockout thresholds to avoid detection.
Dictionary Attack: A type of brute force attack that uses a predefined list of common words and phrases to guess passwords.
Credential Stuffing: An automated attack in which stolen username and password pairs from one breached service are systematically tested against other services to gain unauthorized access. It exploits users who reuse passwords across multiple accounts.
Rainbow Table: A precomputed lookup table used to reverse cryptographic hash functions, allowing attackers to recover plaintext passwords from stolen hashed credentials. Rainbow table attacks are defeated by adding a unique salt to each password before hashing.
Keylogger: A type of spyware that records keystrokes on a device and transmits them to an attacker, capturing sensitive information such as passwords, credit card numbers, and private messages without the user's knowledge.
Phishing: A social engineering attack that uses deceptive emails or messages to trick users into revealing sensitive information.

Topics

Passwords Password Attacks Credential Stuffing Rainbow Tables Keylogger Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →