Module 9.1: Passwords & Password Attacks

1 How Password Authentication Works

A simplified authentication process looks like this:

User
 |
 | Username + Password
 v
Application
 |
 | Authentication request
 v
Identity Store
 |
 | Compare credentials
 v
Success / Failure

A properly designed system should never store the user's password in plaintext. Instead, it stores a derived representation produced by a password hashing function:

Password
    ↓
Salt
    ↓
Password hashing algorithm
    ↓
Stored password hash

When the user logs in again:

Entered password
       ↓
Apply same hashing process
       ↓
Calculated hash
       ↓
Compare with stored hash

If they match, authentication succeeds. The server never needs to store — or even briefly know — the original password.

2 Password Hashing

Password hashing is different from encryption. Encryption is generally reversible if you have the correct key. Hashing is designed to be one-way — there's no key that turns a hash back into the original password.

Modern password storage should use algorithms intentionally designed to make guessing expensive: Argon2, bcrypt, scrypt, or PBKDF2. Older approaches such as unsalted MD5 or SHA-1 should never be used for password storage — they're built for speed, which is exactly the wrong property when an attacker is trying billions of guesses per second.

What is a salt?

A salt is random data added before hashing a password. Without one, every user with the same password gets the same hash:

Password: Password123
Hash: ABC123XYZ

With different salts per user, the resulting hashes differ even for an identical password:

User	Password	Salt	Resulting hash
User A	Password123	SaltA	Hash A
User B	Password123	SaltB	Hash B

Salting defends against precomputed attacks such as rainbow tables (Module 8) — an attacker can no longer look up one hash and instantly know it matches every user who chose that same password.

🔮 Predict first

Two employees, Alice and Bob, both choose the password Summer2026!. Their stored hashes are completely different. Does this mean the hashing algorithm is broken?

Reveal the answer

No — this is exactly what should happen. Each account was assigned its own random salt before hashing, so identical passwords produce different stored hashes. This is the entire point of salting: it stops an attacker who cracks one user's hash from instantly knowing every other user who reused the same password.

3 Password Attacks

Security professionals should understand the major methods used to attack passwords.

Brute-force attack

The attacker tries possible combinations until the correct password is discovered.

Dictionary attack

The attacker tries likely passwords from dictionaries or leaked password lists:

password123
welcome1
football
letmein
companyname123

Password spraying

Instead of attacking one account with thousands of passwords, the attacker tries a small number of common passwords against many accounts:

Summer2026! → user1
Summer2026! → user2
Summer2026! → user3
Summer2026! → user4

Password spraying is specifically designed to stay under account-lockout thresholds — a handful of failed logins per account rarely triggers a lockout policy.

Credential stuffing

Credentials leaked from one website are tried against another. For example, john@example.com / MyPassword123 leaked from Website A might be tested against Microsoft 365, VPN, Google, banking, and the corporate portal. Password reuse is what makes credential stuffing so effective.

Phishing

The victim is directed to a fake login page:

Fake Microsoft 365 page
          ↓
User enters username/password
          ↓
Attacker receives credentials

Modern phishing platforms may also proxy the legitimate authentication session and steal the resulting session token — one reason MFA alone isn't always enough (Lesson 2).

Lab Lab – Identify the Attack

🦡 Hands-on lab

For each scenario, identify which password attack is being described.

🔮 Predict first

A. An attacker tries the password Winter2026! against 4,000 different employee accounts, one attempt each.
B. An attacker takes a list of emails and passwords leaked from an unrelated shopping website and tries them against the corporate VPN.
C. An attacker systematically tries every possible 6-character combination against a single admin account.
D. An attacker tries the 10,000 most commonly used passwords, one at a time, against a single account.

Reveal the answers

A: Password spraying (one password, many accounts, avoiding lockouts). B: Credential stuffing (reused leaked credentials from a different service). C: Brute-force (exhaustive combinations against one account). D: Dictionary attack (a curated list of likely passwords against one account).

Lesson Outcome

You should now be able to explain how passwords are hashed and salted rather than stored in plaintext, and recognise brute-force, dictionary, password-spraying, credential-stuffing and phishing attacks by their distinguishing pattern. Lesson 2 builds directly on this: since passwords alone are single-factor and attackable in all these ways, it covers how MFA, biometrics, FIDO2 and passkeys reduce that risk.

Passwords & Password Attacks

1🔑 How Password Authentication Works

2🔢 Password Hashing