TechKnowSurge

VideoSecurityFree

Common Password Vulnerabilities

Common password vulnerabilities stem from two core risks: passwords that are stolen through social engineering, eavesdropping, or data breaches, and passwords that are guessed due to weak choices and predictable patterns.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Passwords face threats from two primary directions: direct theft and systematic guessing. Theft can occur through social engineering tactics like phishing, shoulder surfing, or in-person eavesdropping, as well as through technical means such as keyloggers, spyware, adversary-in-the-middle attacks, and large-scale data breaches involving compromised servers or stolen databases. When passwords are transmitted without proper protections, they can be intercepted, and hashed passwords obtained from breaches can be cracked using tools like rainbow tables, which map hash values back to their original plaintext passwords. Guessing attacks succeed largely because many users make consistently poor password choices. Brute force attacks try large volumes of combinations systematically, while password spraying tests a single common password across many accounts to avoid detection. Credential stuffing leverages previously leaked username and password pairs, and mask attacks use probabilistic character patterns to narrow down likely combinations. These methods are effective precisely because users frequently rely on dictionary words, common phrases, keyboard patterns, personal information, and simple character substitutions. Human behavior compounds these technical vulnerabilities in predictable ways. Many users write down passwords, reuse the same password across multiple accounts, recycle old passwords after minor changes, or share credentials with others. Recognizing these patterns — both technical and behavioral — is a foundational step in understanding why strong password policies and user education are critical components of any security strategy.

What you'll learn

Identify common password vulnerabilities, including theft methods such as social engineering, keylogging, and adversary-in-the-middle attacks, as well as cracking techniques such as brute force, password spraying, rainbow tables, and credential stuffing
Describe poor password practices that increase susceptibility to compromise, including password reuse, predictable patterns, and sharing credentials

What's covered

Common Password Vulnerabilities

Stolen Passwords
- Social Engineering
  - Phishing Campaigns
  - Shoulder Surfing
- Eavesdropping Methods
  - Keyloggers / Spyware
  - Adversary in the Middle
- Data Breaches
  - Malware on Servers
  - Database Theft
- Rainbow Table Attacks
Guessing Attacks
- Brute Force
- Password Spraying
- Credential Stuffing
- Mask Attacks
Poor Password Decisions
- Weak Password Choices
  - Dictionary Words
  - Personal Information
  - Common Substitutions
- Reuse and Sharing
  - Same Password Multiple Accounts
  - Sharing Passwords
  - Reusing Old Passwords
- Patterns and Sequences
  - Common Phrases or Quotes
  - Repetition and Sequences
- Writing Down Passwords

Key terms

Social Engineering: A manipulation technique that exploits human psychology to trick individuals into revealing confidential information.
Man-in-the-Middle Attack: An attack where an adversary secretly intercepts and potentially alters communications between two parties.
Spyware: Malware that secretly monitors and collects user activity and sends it to a third party without consent.
Brute Force Attack: An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
Phishing: A social engineering attack that uses deceptive emails or messages to trick users into revealing sensitive information.
Keylogger: A type of spyware that records keystrokes on a device and transmits them to an attacker, capturing sensitive information such as passwords, credit card numbers, and private messages without the user's knowledge.
Password Spraying: An attack that attempts a single commonly used password against many different user accounts before moving to the next password, deliberately staying below account lockout thresholds to avoid detection.
Rainbow Table: A precomputed lookup table used to reverse cryptographic hash functions, allowing attackers to recover plaintext passwords from stolen hashed credentials. Rainbow table attacks are defeated by adding a unique salt to each password before hashing.
Credential Stuffing: An automated attack in which stolen username and password pairs from one breached service are systematically tested against other services to gain unauthorized access. It exploits users who reuse passwords across multiple accounts.
Password Reuse: The poor security practice of using the same password across multiple accounts, increasing exposure if one account is compromised.

Topics

Password Security Credential Attacks Social Engineering Brute Force Attacks Credential Stuffing Cybersecurity

Transcript

There are also a lot of common password vulnerabilities.

How Someone Gets a Password

When it comes to passwords, there's really just two ways in which somebody's going to have a password. One is they could know the password for some reason, like maybe they steal the password or they have guessed the password.

Stolen Passwords

If a password is stolen, here's a few different ways that that could have happened.

Maybe there was some sort of social engineering that was happening — maybe a phishing campaign, or somebody was looking over the shoulder while somebody typed in the password, so shoulder surfing. But they could also just be eavesdropping, actually there in person and overhearing somebody say their password. Or maybe they're using some sort of spyware like a keylogger, or maybe they're doing a machine in the middle, an adversary in the middle, and then being able to hear those passwords.

The other thing too is they can get a hold of passwords through some sort of data breach. Maybe there's malware installed on some sort of server and then they're capturing that data, or maybe the network was hacked or the database was stolen.

If there is an adversary in the middle attack and they're listening to a conversation, they're eavesdropping on a conversation, then they might be able to see passwords that are being sent back and forth.

A rainbow table can be used to look up certain information — hashes, to be specific. So they can look up a hash to find out what somebody's password is. We're not going to get deep into that right now, but just know that a rainbow table can be used in order to break passwords.

Guessed Passwords

Many times an adversary doesn't have a hard time guessing a password, because there's a lot of people that make really bad password decisions. Maybe they're doing some sort of brute force of just trying a bunch of different stuff, or there's something called password spraying — really just testing a bunch of different passwords out, or testing a bunch of different users and then the same password. That's what spraying is right there. Just testing out a bunch of combinations to see how to break into a system.

This is probably because most users who haven't had the proper training make terrible password decisions. They use common substitutions and common dictionary words. They use information that's known out there, things like personal information that maybe everybody else knows about. They use things like credential stuffing, where they have access to some old database. They have something called mask attacks, where they can use different masks in order to try different combinations that are likely. So there's a lot of different guessing methods that make certain passwords vulnerable to being cracked.

Bad Password Habits

Other things that humans are notorious for doing are using some sort of repetition or sequences, using patterns, dictionary words, common phrases or quotes, and personal information. Many users also write down their password, or use some sort of sequence in their password history. They use the same passwords for multiple accounts. They reuse old passwords, or they share their passwords with others.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →