← Years 9–10 Digital Systems

Brute-force and dictionary attacks

An attack that tries many passwords automatically until one works. A dictionary attack tries common words and leaked passwords first. Long passwords and lockouts slow it down.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 26, IGCSE Computer Science 0478 — 5.3 Cyber Security — Module 13, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 20, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 102, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 34, WA Computer Science ATAR Year 11 — Cyber Security — Module 107

Understanding Brute-force and dictionary attacks in Years 9–10 Digital Systems

What it does: The check counts failed attempts and locks the account at 5, so an automated attack cannot keep guessing. The loop reuses leaked pairs on another login, which is credential stuffing and works when people re-use passwords. A brute-force attack uses automation to try huge numbers of passwords. Watching someone type is a different trick called shoulder surfing. Each extra character multiplies the number of guesses needed, so longer passwords take much longer to crack. If one site is breached, attackers try that same login elsewhere. Use a different password for each account. Long, unique passwords make guessing slow, and lockouts limit how many guesses an attacker gets.

Common mistakes: The counter must go UP after each failed guess (failed + 1). Subtracting means it never reaches 5, so the account would never lock and a brute-force attack could keep guessing. The list is missing its closing bracket ]. A dictionary attack stores common passwords in a complete list so it can try each one.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Brute-force and dictionary attacks to a class →

This module's key terms are also in a printable crossword (Modules 25–40) and word search (Modules 13–40).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which describes a brute-force attack?
Software automatically tries many passwords until one worksA person guesses one password by watching over your shoulder
Matches
password = "cat123" # strong because it has numbers
↓
A short password with a common word is still weak. A dictionary attack would guess it quickly, so a long passphrase is better.
Applying
Meanings
Term
brute-force attack
Meaning
An attack that tries many passwords automatically until one works. A dictionary attack tries common words and leaked passwords first. Long passwords and lockouts slow it down.
Practice
FOR EACH guess IN passwordList
Testing
Gaps
FOR EACH word IN
Check Answer
Spots
3 guess = input('Guess: ')
4 failed = failed - 1

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Chameleon' badge — Type Shifter, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which describes a brute-force attack?
A. Software automatically tries many passwords until one works ✓
B. A person guesses one password by watching over your shoulder
A brute-force attack uses automation to try huge numbers of passwords. Watching someone type is a different trick called shoulder surfing.
2. A dictionary attack tries which passwords first?
A. Random strings like 'k9#Qz!v2Lm' in order
B. Common words and known passwords like 'password123' ✓
A dictionary attack starts with a list of likely passwords, because many people choose common words or leaked passwords.
3. Which password is harder for a brute-force attack to crack?
A. A 16-character passphrase of random words ✓
B. An 6-character password with a number
Each extra character multiplies the number of guesses needed, so longer passwords take much longer to crack.
4. What does an account lockout do?
A. Blocks login for a while after too many failed attempts ✓
B. Deletes the account after one wrong password
Lockouts slow down automatic guessing by stopping repeated attempts. They do not delete the account.
5. Credential stuffing is when attackers...
A. Try every possible letter combination on one account
B. Try passwords leaked from one site on many other sites ✓
Credential stuffing uses real leaked username and password pairs, hoping people re-used them. Trying every combination is a pure brute-force attack.

Match the Pairs

for guess in all_combinations: → A brute-force attack loops through every possible password combination until one works
for word in common_passwords: → A dictionary attack tries a list of common words and leaked passwords first
Account lockout stops an attacker by locking the account after too many failed logins → if failed_attempts >= 5: lock_account()
Credential stuffing tries leaked username and password pairs from one site on other sites → for user, pw in leaked_list: login(user, pw)
password = "cat123" # strong because it has numbers → A short password with a common word is still weak. A dictionary attack would guess it quickly, so a long passphrase is better.
if login_failed: allow_unlimited_tries() → Allowing unlimited tries lets a brute-force attack keep guessing. Lock the account or add delays after several failed attempts.

Key Term

brute-force attack
An attack that tries many passwords automatically until one works. A dictionary attack tries common words and leaked passwords first. Long passwords and lockouts slow it down.

Fill in the Blanks

1. FOR EACH word IN wordlist LOGIN(user, word)
Hint: Type the name of the list of common and leaked passwords that a dictionary attack loops through.
2. combinations ← 26 ^ length
Hint: Type the operator that raises a number to a power. Each extra character multiplies the guesses needed.
3. IF attempts >= 5 THEN LOCK(account)
Hint: Type the comparison operator that means 'greater than or equal to' so the account locks after too many failed tries.
4. FOR EACH pair IN leaked LOGIN(site, pair.email, pair.pass)
Hint: Type the function that tries each leaked email and password pair on another website (credential stuffing).
5. attempts ← 0 WHILE guess ≠ password attempts ← attempts + 1
Hint: Type the keyword that keeps a brute-force loop repeating while the guess is still wrong.

Spot the Error

Question 1
A failed = 0
B while failed < 5:
C guess = input('Guess: ')
D failed = failed - 1
E print('Account locked')
Line D — The counter must go UP after each failed guess (failed + 1). Subtracting means it never reaches 5, so the account would never lock and a brute-force attack could keep guessing.
Question 2
A words = ['password', '123456'
B for w in words:
C if w == secret:
D print('Cracked!')
Line A — The list is missing its closing bracket ]. A dictionary attack stores common passwords in a complete list so it can try each one.
Question 3
A secret = '4821'
B for n in range(1000):
C guess = str(n).zfill(4)
D if guess == secret:
E print('Found', guess)
Line B — A 4-digit PIN has 10000 possibilities (0000 to 9999). range(1000) only tries 0 to 999, so a brute-force attack would miss PINs like 4821. It should be range(10000).
Question 4
A combos = 26 * 8
B speed = 1000000
C seconds = combos / speed
D print(seconds)
Line A — The number of combinations is 26 to the power of 8 (26 ** 8), not 26 times 8. Each extra character multiplies the work, which is why longer passwords take much longer to crack.
Question 5
A leaked = load('leaked.txt')
B site = 'shop.com'
C for user, pw in leaked:
D login(site, user, user)
Line D — Credential stuffing tries each leaked username with its leaked password (pw). Passing user twice would try the username as the password instead.

Student with a class code? Join your class →