About this interactive
What you are doing: deciding whether the attacker stole the password or guessed it.
Stolen: the password already exists somewhere and the attacker takes it. Social engineering such as phishing, shoulder surfing or overhearing it in person; spyware such as a keylogger; an adversary in the middle reading it on the network; or a data breach, where malware on a server or a stolen database hands it over.
Guessed: the attacker works it out by trying. Brute force tries combination after combination. Password spraying tries one or a few common passwords against many users. And because many people make bad password decisions, guesses built from dictionary words, common substitutions, personal information everyone knows, and masks of likely shapes often succeed.
How to use it: ask whether the attacker took the password from somewhere or tried candidates until one worked. A wrong answer resets your streak and shows the right bin; land five in a row to finish.
What you'll learn
- Tell how an attacker got a password: stolen (phishing, shoulder surfing, eavesdropping, keyloggers and spyware, adversary in the middle, data breaches) or guessed (brute force, password spraying, dictionary words, personal information, common substitutions, mask attacks)
Aligned to
CompTIA Security+
2.4
Given a scenario, analyze indicators of malicious activity.
2.2
Explain common threat vectors and attack surfaces.
Key terms
- Brute Force Attack
- An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
- Password Spraying
- An attack that attempts a single commonly used password against many different user accounts before moving to the next password, deliberately staying below account lockout thresholds to avoid detection.
- Keylogger
- A type of spyware that records keystrokes on a device and transmits them to an attacker, capturing sensitive information such as passwords, credit card numbers, and private messages without the user's knowledge.
- Shoulder Surfing
- An attack in which an adversary physically observes a victim entering credentials or access information by looking over their shoulder or from close proximity.
- Phishing
- A social engineering attack that uses deceptive emails or messages to trick users into revealing sensitive information.
- Mask Attack
- A password cracking technique that exploits known patterns in passwords — such as a capital letter followed by lowercase letters and ending in numbers — to dramatically narrow the search space compared to a full brute-force attempt.
Topics
Brute Force Attack
Password Spraying
Keylogger
Shoulder Surfing
Phishing
Mask Attack
Interactive
Streak Sort
About TechKnowSurge
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →