Password attacks and defences: spraying, stuffing and cracking

Why passwords are targeted

Stolen or weak credentials are one of the most common ways into an organisation. A valid username and password lets an attacker log in like a normal user, often without triggering any malware alerts. Understanding the main attack types helps you pick the right defence for each.

Online attacks

Online attacks try passwords against a live login page or service.

• Brute force and guessing: many attempts against one account. Easy to slow down with rate limiting and lockout.
• Password spraying: one or two very common passwords (such as a season and year) tried against many accounts. Because each account sees only a few failures, per-account lockout does not trigger.
• Credential stuffing: username and password pairs leaked from another website are tried automatically. It works because people reuse passwords.
• MFA fatigue: if an attacker already has the password, they trigger repeated push approvals hoping the user taps "approve" to make it stop.

Offline cracking and hashing

Systems should never store passwords in plain text. They store a hash, a one-way fingerprint. If an attacker steals the hash database, they can try candidate passwords offline at high speed, hashing each guess and comparing results, with no lockout to stop them. This is offline cracking.

A salt is a random value stored with each hash so identical passwords produce different hashes and precomputed tables are useless. Try the hash tool to see how a tiny change in input completely changes the output.

Defences that work

1. Turn on MFA everywhere, preferring phishing-resistant methods such as passkeys or FIDO2 security keys. Use number matching for push approvals.
2. Follow current guidance such as NIST SP 800-63B: favour length over complexity rules, check new passwords against lists of breached and common passwords, and do not force routine expiry without cause.
3. Encourage a password manager so every account gets a long, unique password. The password generator shows what good looks like.
4. Rate-limit and lock out sensibly, using progressive delays to avoid letting attackers lock everyone out.
5. Monitor for many failed logins across many accounts from one source (spraying) and for logins from unusual places.
6. Hash correctly in any application you build.

Example lockout settings for a Windows standalone host and a Linux host using pam_faillock:

net accounts /lockoutthreshold:10 /lockoutwindow:15 /lockoutduration:15

# /etc/security/faillock.conf
deny = 10
fail_interval = 900
unlock_time = 900

Tip: password auditing (for example checking your domain's hashes against breached lists) is a legitimate defensive task, but it handles very sensitive data. Do it only with written approval and a clear process.