TechKnowSurge

NIST 800-53 IA-5 CompTIA A+ Core 2 2.4 Cisco CCST Cybersecurity 1.2 ISC2 CC 1.1 CompTIA Tech+ 6.5 CompTIA Tech+ 6.6 Cisco CCNA 5.4 Cisco CCST Cybersecurity 1.4

VideoSecurityFree

Threats - How Passwords are Hacked

Credential-based attacks are among the most common ways threat actors gain unauthorized access to systems and networks. This content covers the primary methods used to steal or guess passwords, including social engineering, eavesdropping, brute force techniques, rainbow table lookups, and credential stuffing.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Password attacks are a primary vector through which threat actors compromise systems, networks, and user accounts. Attackers obtain credentials through one of two broad approaches: they either acquire the password directly or attempt to guess it. Direct acquisition methods include phishing campaigns, shoulder surfing, keyloggers that capture keystrokes in plain text, man-in-the-middle attacks that intercept credentials in transit, and large-scale data breaches that expose entire databases of usernames and passwords. When stolen passwords are encrypted, attackers may turn to rainbow tables, precomputed reference tables that map plain-text passwords to their encrypted equivalents, allowing rapid lookups without needing to reverse-engineer the encryption algorithm itself. Long, complex passwords significantly limit the effectiveness of this technique. Guessing-based attacks take several forms, each exploiting different weaknesses in how passwords are created and reused. Brute force attacks systematically try every possible character combination, while password spraying flips the approach by testing a single known or default password against many different accounts. Dictionary attacks target common words or phrases, and mask attacks exploit predictable patterns such as incrementing a number at the end of a password. Credential stuffing leverages compiled databases of previously breached credentials, testing known username and password pairs across unrelated services to exploit the widespread habit of password reuse. Together, these techniques underscore the importance of strong password policies, unique credentials across accounts, and ongoing monitoring for compromise.

What you'll learn

Distinguish between credential theft and credential guessing techniques, including social engineering, eavesdropping, brute force, spraying, dictionary attacks, rainbow tables, credential stuffing, and mask attacks
Explain how rainbow tables are used to reverse-engineer hashed passwords and why strong, complex passwords reduce their effectiveness

What's covered

Password Hacking Methods

How Passwords Are Obtained
- Knowing the Password
  - Social Engineering
  - Shoulder Surfing
  - Data Breaches
- Eavesdropping
  - Key Loggers
  - Man-in-the-Middle Attack
Password Guessing Attacks
- Brute Force Attack
  - Tries All Combinations
  - Common Passwords
- Password Spraying
  - One Password Many Accounts
  - Exploits Default Passwords
- Dictionary Attack
  - Single or Multiple Words
- Mask Attack
  - Exploits Password Patterns
  - Incremental Password Changes
Stolen Credential Techniques
- Rainbow Tables
  - Plain Text vs Encrypted
  - Defeats Weak Passwords
- Credential Stuffing
  - Uses Breached Databases
  - Tests Credentials Across Sites
- Personal Info Guessing
  - Birthdays and Addresses
Defense Awareness
- Use Strong Long Passwords
- Avoid Default Passwords
- Check Have I Been Pwned
- Future Password Policies

Aligned to

NIST 800-53

IA-5 Authenticator Management

CompTIA A+ Core 2

2.4 Explain common social-engineering attacks, threats, and vulnerabilities.

Cisco CCST Cybersecurity

1.2 Explain common threats and vulnerabilities

1.4 Explain encryption methods and applications

ISC2 CC

1.1 Understand cybersecurity concepts

CompTIA Tech+

6.5 Explain password best practices

6.6 Explain common uses of encryption

Cisco CCNA

5.4 Describe security password policy elements

Key terms

Social Engineering: A manipulation technique that exploits human psychology to trick individuals into revealing confidential information.
Brute Force Attack: An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
Dictionary Attack: A type of brute force attack that uses a predefined list of common words and phrases to guess passwords.
Man-in-the-Middle Attack: An attack where an adversary secretly intercepts and potentially alters communications between two parties.
Hash Function: A mathematical algorithm that converts input data of any size into a fixed-size output value used to verify data integrity.
Rainbow Table: A precomputed lookup table used to reverse cryptographic hash functions, allowing attackers to recover plaintext passwords from stolen hashed credentials. Rainbow table attacks are defeated by adding a unique salt to each password before hashing.
Password Spraying: An attack that attempts a single commonly used password against many different user accounts before moving to the next password, deliberately staying below account lockout thresholds to avoid detection.
Credential Stuffing: An automated attack in which stolen username and password pairs from one breached service are systematically tested against other services to gain unauthorized access. It exploits users who reuse passwords across multiple accounts.
Mask Attack: A password cracking technique that exploits known patterns in passwords — such as a capital letter followed by lowercase letters and ending in numbers — to dramatically narrow the search space compared to a full brute-force attempt.
Eavesdropping: The unauthorized interception of network traffic or keystrokes to capture credentials as they are transmitted or entered.

Topics

Password Attacks Credential Theft Brute Force Rainbow Tables Social Engineering Credential Stuffing Cybersecurity

Transcript

Known or guessed

Another way a threat agent is going to get into our networks, into our data, into the areas we don't want them to get into, is by credentials, by hacking our credentials, by hacking our passwords.

When it comes to passwords being hacked, there are really just two categories. Number one, either the hacker knows the password, or they have guessed at the password. If they know the password, then either that password has been told to them or they have stolen it somehow. So that is the know the password, and then there is the guess the password, and there are a few ways that they can actually guess passwords.

How a password gets stolen

There are a lot of different methods in which a password could be stolen. For instance, social engineering is an example, whether it is some sort of phishing campaign that has happened, or some sort of shoulder surfing. They could steal it from the actual user themselves.

Another thing that can happen is eavesdropping. There are times that we type passwords into our machines, or the password is being sent across the network, and if that gets intercepted and listened to. Maybe it is a keylogger as we are typing it into the keyboard, as it is sending it across. Perhaps there is a man in the middle, where they can take a look at the packets that are being sent across and see what your password is.

There are also data breaches. Maybe there is some sort of malware, or the network was hacked, where they got the database of information of a bunch of passwords and usernames of the company.

Just a brief insight into this man-in-the-middle, or on-path. Man-in-the-middle or on-path could be a form of eavesdropping, although there are other purposes for having a man-in-the-middle attack as well. A man-in-the-middle attack is if you have a machine that wants to talk to a server over here, but somehow the information is actually going through some other device that was not intended. Now this is a man in the middle, or a device in the middle, or like I say an on-path attack, and so this is one of the attacks that can happen for eavesdropping.

Plain text, encrypted, and rainbow tables

A hacker could get a hold of your password in one of a couple of different ways. Number one is that password could be just plain text, which means they see what your password is. For instance, let's say they used the keylogger and got your password, and that keylogger just records the keystrokes that you have and sends it to them, and so they would be able to see exactly what your password is in plain text.

But it also could come to them encrypted. An example like this is, let's say they go and get a password database that they have downloaded, that they hacked into somebody's site and they got a hold of their people's usernames and passwords. If it is encrypted correctly, then they have an encrypted form of your password, and that can be difficult for them to actually figure out what your actual password is, because with a good encryption it is going to be almost impossible. With a good encryption they are not going to be able to reverse engineer that and figure out what your actual password is.

But there is this thing called a rainbow table that can actually help them out. A rainbow table is a reference table. Once again, it is hard to reverse engineer from a good encrypted password to figure out what the plain text is, but they do know what the algorithms are to go the other way, to take your password and encrypt it. They do know how that part operates, how that part works. So what they do is they take a bunch of different passwords, or maybe some sort of sequences, and they plug it into the algorithm, and then they figure out what the encrypted version of that looks like and they put it into a table. That is called a rainbow table. The rainbow table is going to record plain text passwords and then the encrypted passwords.

Where this comes into play is now, if they have your encrypted password, they are going to look up on this table to try to find what your plain text password is. The best way to be able to combat this is to have good passwords, long passwords that are well constructed, and then it is going to make it almost impossible for them to use rainbow tables, because rainbow tables definitely have their limits.

Brute force and spraying

Then you have the brute force attack. A brute force attack is just when they are guessing. They are just going to guess a lot of credential combinations to try to gain access to a system. So they are looking at maybe it is a username and a password to get into the system. One thing that is common with a brute force attack is that the username would be given. They would have some sort of given username that they have, and then they are trying a bunch of different passwords that they do not know to see if they can gain access to it.

But spraying kind of works in the opposite. Spraying is actually a type of brute force attack, but spraying is that they have a single password that they are trying on a lot of different usernames or a lot of different accounts. A good example of this might be that there is some sort of company that has a default password to get into a certain system, and the hacker knows this, so they use this default password but then they try a lot of different accounts to try to gain access into that system. If your company uses those default passwords, it makes you susceptible to this type of an attack.

Guessing methods

A hacker has ways to be able to shortcut to find out what your password is going to be. They essentially take an educated guess. Let's talk about some guessing methods that they have.

It could be that they are just trying everything. They start out with, let's say it is a system that has three characters as the minimum password. Well, then they could guess 000, 001, 002, 003, and so on and so forth, and just guess every single character all the way up to the end, zzz. And then they start out with four characters and try four characters, and then five characters, and just keep guessing from that perspective to break into that system.

Or perhaps they are trying a bunch of common passwords. It is amazing how the same passwords are used over and over and over again out there. It is kind of insane, actually. So don't use your default passwords, make sure you change those passwords, make sure it is not one of those common passwords that are out there.

There are also dictionary passwords, where they will just try a single dictionary word or multiple dictionary words. So don't use a single or double dictionary word. Make sure that if you are using dictionary words you are using many of them. That is going to be a key with that.

They will also take a look at information they know. Maybe they know your date of birth, maybe they know your kid's date of birth, maybe they know the address that you live at. They will use all of those numbers and sequences, and they will use that information to try to break into your accounts.

Credential stuffing

Then there is something called credential stuffing. Credential stuffing just means that, let's say there is a company XYZ and sometime in the past you have created an account for XYZ, and that company got compromised and all their passwords were hacked and stolen. Now those get uploaded into this database for all cyber criminals to be able to have access to, and you could actually go out there and download this database of all these past hacked passwords.

What they do then is they find out, well, you have this password at this one site that you got onto, this XYZ site, so what I am going to do is start trying out that same username and password combination for all of these other sites to see if I can break into things like your social media. So credential stuffing is using this database that is accessible to anyone out there, taking the compromised passwords that already exist out there on your account, and trying those on your other accounts that you have.

Mask attacks

Then we have the mask attack. A lot of times people will use some sort of pattern that they will have to be able to access different sites. A great example of this is when you require your users to change passwords, they just increment the numbers up. So whatever their password is with a one at the end, and their password with the two at the end, the password with three at the end. Well, it is pretty easily guessable what the sequence is going to be.

Same thing if you have multiple companies that got their sites compromised. Somebody can take a look at what your passwords are and reverse engineer that to figure out what your next password is going to be for any particular site. So if you use some sort of patterns to be able to remember your different passwords to different sites, that could be problematic.

Checking your own exposure

Just as an example, I have gone to this Have I Been Pwned site right here, which I have utilized quite a bit. I typed in one of my past emails that I had at a company that I worked for, to see what other companies I had registered for and it got hacked. As you can see here, these are all of the companies in the databases that got hacked that had information that was compromised. For instance, this one, I had an email address, an employer, geographical location, job titles, names, phone numbers and social media profiles hacked. Here is a LinkedIn one, and as part of it, all sorts of information along that.

As you can see here, this is just one of my many emails that I have that has a ton of information that has been hacked out there. So this is a good site to go to and just check out to see if you have had an issue in the past where your username and password has been hacked out there.

As you can see, threat agents have a few different ways they can approach getting people's usernames and passwords, and it can be quite devastating to those people and the networks that they are on. So we are really going to want to safeguard against that.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →