Brute-force and dictionary attacks

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which describes a brute-force attack?

A Software automatically tries many passwords until one works

B A person guesses one password by watching over your shoulder

2. A dictionary attack tries which passwords first?

A Random strings like 'k9#Qz!v2Lm' in order

B Common words and known passwords like 'password123'

3. Which password is harder for a brute-force attack to crack?

A A 16-character passphrase of random words

B An 6-character password with a number

4. What does an account lockout do?

A Blocks login for a while after too many failed attempts

B Deletes the account after one wrong password

5. Credential stuffing is when attackers...

A Try every possible letter combination on one account

B Try passwords leaked from one site on many other sites

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1for guess in all_combinations:		AA short password with a common word is still weak. A dictionary attack would guess it quickly, so a long passphrase is better.
2for word in common_passwords:		BA dictionary attack tries a list of common words and leaked passwords first
3Account lockout stops an attacker by locking the account after too many failed logins		CA brute-force attack loops through every possible password combination until one works
4Credential stuffing tries leaked username and password pairs from one site on other sites		Dif failed_attempts >= 5: lock_account()
5password = "cat123" # strong because it has numbers		EAllowing unlimited tries lets a brute-force attack keep guessing. Lock the account or add delays after several failed attempts.
6if login_failed: allow_unlimited_tries()		Ffor user, pw in leaked_list: login(user, pw)

Definitions

brute-force attack

Fill in the Blanks

Complete each line of code by filling in the missing parts.

FOR EACH word IN ________ LOGIN(user, word)

combinations ← 26 _ length

IF attempts __ 5 THEN LOCK(account)

FOR EACH pair IN leaked _____(site, pair.email, pair.pass)

attempts ← 0 _____ guess ≠ password attempts ← attempts + 1

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A failed = 0

B while failed < 5:

C guess = input('Guess: ')

D failed = failed - 1

E print('Account locked')

Question 2

A words = ['password', '123456'

B for w in words:

C if w == secret:

D print('Cracked!')

Question 3

A secret = '4821'

B for n in range(1000):

C guess = str(n).zfill(4)

D if guess == secret:

E print('Found', guess)

Question 4

A combos = 26 * 8

B speed = 1000000

C seconds = combos / speed

D print(seconds)

Question 5

A leaked = load('leaked.txt')

B site = 'shop.com'

C for user, pw in leaked:

D login(site, user, user)

Answer Key

Brute-force and dictionary attacks

Section A: Quick Questions

A — Software automatically tries many passwords until one works

B — Common words and known passwords like 'password123'

A — A 16-character passphrase of random words

A — Blocks login for a while after too many failed attempts

B — Try passwords leaked from one site on many other sites

Section B: Match the Pairs

for guess in all_combinations: → A brute-force attack loops through every possible password combination until one works

for word in common_passwords: → A dictionary attack tries a list of common words and leaked passwords first

Account lockout stops an attacker by locking the account after too many failed logins → if failed_attempts >= 5: lock_account()

Credential stuffing tries leaked username and password pairs from one site on other sites → for user, pw in leaked_list: login(user, pw)

password = "cat123" # strong because it has numbers → A short password with a common word is still weak. A dictionary attack would guess it quickly, so a long passphrase is better.

if login_failed: allow_unlimited_tries() → Allowing unlimited tries lets a brute-force attack keep guessing. Lock the account or add delays after several failed attempts.

Section C: Definitions

brute-force attack — An attack that tries many passwords automatically until one works. A dictionary attack tries common words and leaked passwords first. Long passwords and lockouts slow it down.

Section D: Fill in the Blanks

FOR EACH word IN wordlist
  LOGIN(user, word)

combinations ← 26 ^ length

IF attempts >= 5 THEN
  LOCK(account)

FOR EACH pair IN leaked
  LOGIN(site, pair.email, pair.pass)

attempts ← 0
WHILE guess ≠ password
  attempts ← attempts + 1

Section E: Spot the Error

D — The counter must go UP after each failed guess (failed + 1). Subtracting means it never reaches 5, so the account would never lock and a brute-force attack could keep guessing.

A — The list is missing its closing bracket ]. A dictionary attack stores common passwords in a complete list so it can try each one.

B — A 4-digit PIN has 10000 possibilities (0000 to 9999). range(1000) only tries 0 to 999, so a brute-force attack would miss PINs like 4821. It should be range(10000).

A — The number of combinations is 26 to the power of 8 (26 ** 8), not 26 times 8. Each extra character multiplies the work, which is why longer passwords take much longer to crack.

D — Credential stuffing tries each leaked username with its leaked password (pw). Passing user twice would try the username as the password instead.