CAPEC-16 Dictionary-based Password Attack

An attacker tries each of the words in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user was a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern. Dictionary Attacks differ from similar attacks such as Password Spraying (CAPEC-565) and Credential Stuffing (CAPEC-600), since they leverage unknown username/password combinations and don't care about inducing account lockouts.

1. [Explore] [Determine application's/system's password policy] Determine the password policies of the target application/system. 2. [Explore] [Select dictionaries] Pick the dictionaries to be used in the attack (e.g. different languages, specific terminology, etc.) 3. [Explore] [Determine username(s) to target] Determine username(s) whose passwords to crack. 4. [Exploit] [Use dictionary to crack passwords.] Use a password cracking tool that will leverage the dictionary to feed passwords to the system and see if they work.

• The system uses one factor password based authentication. • The system does not have a sound password policy that is being enforced. • The system does not implement an effective password throttling mechanism.

• [Low] A variety of password cracking tools and dictionaries are available to launch this type of an attack.

• Confidentiality, Access Control, Authentication: Gain Privileges • Confidentiality: Read Data • Integrity: Modify Data

• Create a strong password policy and ensure that your system enforces this policy. • Implement an intelligent password throttling mechanism. Care must be taken to assure that these mechanisms do not excessively enable account lockout attacks such as CAPEC-2. • Leverage multi-factor authentication for all authentication services.