1.7 Password Cracking and Social Engineering

Password Cracking Methods

Attackers use several methods to guess or crack passwords. A brute-force attack tries every possible combination of characters. A dictionary attack tries common words and known passwords from lists. Rainbow tables use precomputed hash values to reverse hashed passwords quickly. Weak, short, or reused passwords make all these attacks faster and more successful.

Social Engineering Basics

Social engineering manipulates people (not computers) into revealing sensitive information or granting access. It exploits trust, fear, or urgency rather than technical vulnerabilities. Because humans are often the weakest link in a security system, attackers frequently find it easier to trick a person than to break through technical defenses.

Common Social Engineering Attacks

Phishing uses fake emails/websites to trick users into giving up credentials. Pretexting involves creating a false scenario to gain trust. Shoulder surfing is watching someone enter credentials. Tailgating means following an authorized person into a restricted area. Awareness training and strong authentication help reduce these risks.

Key terms

Brute-force attack

An attack that tries every possible character combination to guess a password.

Dictionary attack

An attack that uses lists of common words and known passwords to guess credentials.

Rainbow table

A precomputed table of hash values used to quickly reverse hashed passwords.

Phishing

A social engineering attack using fake emails or websites to trick users into revealing sensitive information.

Pretexting

Creating a false scenario or identity to gain someone's trust and extract information.

Try an AP-style question

Which password resists a brute-force attack best?

1. Your birth date
2. A long random passphrase
3. Your pet's name plus 1
4. A short common word