Appendix C. Password Attacks and Social Engineering — The Art of Opening People

• Target reader: All levels (understandable even for non-technical readers)
• Purpose: Exam prep summary, security awareness training material, revision map

⚠️ All techniques in this appendix are for your own lab and legal platforms only. Phishing or password attempts against real people or organizations are crimes in themselves.

The strongest encryption and the freshest patches are powerless before one person’s click. This appendix covers how to attack people and passwords rather than systems — and how to fight back.

C-0. The Map at a Glance

C-1. Brute Force and Dictionary Attacks

Definition: The most primitive attack — trying passwords against a login form. Pure brute force (every combination) is realistically slow, so in practice you use dictionary attacks: lists of leaked passwords (like rockyou.txt) and rule-based mutations (password → Password1!).

Why it works: Because people choose memorable passwords, and those choices are astonishingly predictable. A top-1-million dictionary covers a significant share of all accounts.

Defense: Login rate limiting and account lockout, increasing delays (exponential backoff), and CAPTCHAs. Service operators should also block passwords that overlap with known leaked lists.

C-2. Hash Cracking

Definition: When you obtain hashes (from a database leak, say), you hash candidate passwords and look for a match. Hashes can’t be reversed — but "compute forward and compare" works just fine.

Tools and intuition: hashcat (GPU-accelerated) and john are the standards. A single GPU can try billions of candidates per second, so short passwords are only a matter of time. A rainbow table is a precomputed hash→password lookup — but it’s useless against hashes with a salt attached.

The core of defense is your choice of hash algorithm.

A slow hash function is no burden for legitimate logins (a few times a day), but it’s devastating to a cracker making billions of attempts per second.

C-3. Password Spraying

Definition: Instead of trying many passwords against one account, you try one common password against a huge number of accounts. It’s a technique designed to evade account lockout (which triggers on consecutive failures).

Attack flow: Try a seasonal password like Spring2025! exactly once against an organization’s entire account list → collect the accounts that pass without triggering lockouts → repeat with the next season’s password.

Defense: Lockout policies can’t stop spraying. Instead, detect the pattern of "many accounts failing with the same password," block leaked dictionaries, and above all rely on MFA as the definitive shield.

C-4. Credential Stuffing

Definition: An attack that takes an ID/password list leaked from company A in the past and tries it as-is at companies B and C. It exploits the human habit of password reuse.

Defense: For users, a different password for every site — since no one can memorize them all, a password manager is effectively the only answer. On the service side, defenses include checking against leaked lists, MFA, and anomalous login detection (unusual location or device).

C-5. Phishing

Definition: An attack that impersonates a trusted entity (a bank, your company’s IT team, a courier) to make the victim hand over credentials or money themselves. It attacks psychology, not technology.

Dissect it and there are four ingredients:

1. Impersonation: Forged sender addresses and domains (typosquatting like naver-secure.com)
2. Urgency: "Your account will be suspended if no action is taken within 24 hours" — a device to paralyze judgment
3. A veneer of legitimacy: A login page cloned down to the logos and wording
4. A call to action: Clicking a link or running an attachment

Defense: Scrutinize sender addresses, re-verify urgent requests through a separate channel (official app or phone), type links directly instead of clicking, and build a culture of reporting phishing. On the technical side, there are SPF/DKIM/DMARC email authentication and web filtering.

C-6. Spear Phishing, Smishing, Vishing

• Spear Phishing: Phishing custom-built after researching a specific person or organization (social media, org charts). Because it uses real connections and context — like "the approval document Director Kim requested" — its success rate is far higher than generic phishing.
• Smishing: SMS-based. Short messages and shortened URLs make it hard to tell real from fake.
• Vishing: Phone-based. The authority in a voice ("This is the prosecutor’s office," "This is the security team") is the weapon.

Defense: The channel-separation principle — verify through a path you already knew, not the channel the request came in on. For companies, reporting procedures and simulated drills are the best vaccine.

C-7. Pretexting and Physical Access

• Pretexting: A technique for extracting information by acting out a fabricated identity and situation (internal auditor, equipment technician). One phone call collects internal terminology and org details — and that information becomes the trust material for the next attack.
• USB Drops: The classic trick of leaving a USB labeled "2025 Salary Table" in a parking lot so someone plugs it in. Curiosity beats security policy.
• Tailgating: Slipping in behind an employee who badges through the door. When physical security falls, logical security falls with it.

Defense: Identity verification procedures (callback confirmation), a ban on using unfamiliar storage media, and per-person authentication at physical entrances.

C-8. MFA Fatigue

Definition: An attacker who has already stolen your password sends push approval requests over and over until the victim, worn down by annoyance, taps "Approve." It doesn’t break MFA — it makes a person break it for them.

Defense: Number-matching MFA (typing the on-screen number into the app), hardware keys (FIDO2), and a reporting procedure for bursts of approval requests. The victim’s rule is simple: an approval request you never triggered is always denied.

C-9. A Comprehensive Checklist for Defenders

Things individuals and organizations can start doing today.

• [ ] Adopt a password manager — a different, long, random password for every site
• [ ] Enable MFA — preferably a hardware key or number matching
• [ ] Make "urgent request = suspicion" a habit — re-verify through a separate channel
• [ ] Regularly check whether your accounts have been leaked (Have I Been Pwned, etc.)
• [ ] If you run a service: Argon2/bcrypt hashing, login rate limiting, spraying-pattern detection, email authentication (SPF/DKIM/DMARC)
• [ ] If you’re an organization: regular simulated phishing drills and rewards for reporting — a culture where "the person who reported" gets praised, not "the person who got fooled"

Summary

The techniques in this appendix share an uncomfortable common thread: they target not technical perfection but human habits. Reused passwords, judgment that crumbles under urgency, the instinct to avoid hassle — attackers are experts on these instincts.

Defense, in turn, begins by not leaving things to instinct. Hand memory over to a password manager, add one more layer with MFA, and turn re-verification into a habit. Build a structure where tools cover the weaknesses of instinct, and you get a system where people can make mistakes and still be okay.

Hands-on password cracking practice is covered in the Python and hash parts of Levels 1~2 and the Level 4 OSCP part, while the defensive perspective on social engineering is covered in the security habits parts of Levels 0~1.