A password attack is an attempt to access password-secured devices, systems, networks, or data. - **Brute-force attacks**, which *iterate through passwords until they find one that works*. Actual brute-force methods can be more complex than just using a list of passwords and often involve word lists that use common passwords, words specifically picked as likely to be used by the target, and modification rules to help account for complexity rules. Regardless of how elegant or well thought out their input is, brute force in the end is simply a process that involves trying different variations until it succeeds. - **Password spraying attacks** are a form of brute-force attack that attempts to *use a single password or small set of passwords against many accounts*. This approach can be particularly effective if you know that a target uses a specific default password or a set of passwords. For example, if you were going to attack a sports team's fan website, common chants for the fans, names of well-known players, and other common terms related to the team might be good candidates for a password spraying attack. - **Dictionary attacks** are yet another form of brute-force attack that *uses a list of words for their attempts*. Commonly available brute-force dictionaries exist, and tools like John the Ripper, a popular open source password cracking tool, have word lists (dictionaries) built in. Many penetration testers build their own custom dictionaries as part of their intelligence gathering and reconnaissance processes. Password attacks fall under the [[Communications and Network Security]] domain.