A dictionary attack is a password-guessing technique that uses a program to test passwords from a list of common or likely passwords. It targets the weakness of predictable credentials rather than trying every possible character combination. section 11.2.1
Distinguish dictionary attacks from related password attacks:
- A dictionary attack runs through a dictionary, meaning a prepared list of common passwords. section 11.2.1
- A brute-force attack tests every possible combination of letters, numbers, and special characters. section 11.2.1 section 11.6
- Guessing may also use target information gathered through OSINT reconnaissance, such as birthdays or pet names. section 11.2.1
- Strong, sufficiently long, complex, unique, and hard-to-guess passwords reduce exposure to dictionary and brute-force attacks. section 11.2.1 section 11.6
