Password spraying vs brute force vs credential stuffing
Brute force tries many passwords against one account. Password spraying tries one or a few common passwords against many accounts so no single account hits its lockout limit. Credential stuffing reuses username and password pairs leaked from other breaches, and cracking recovers passwords from stolen hashes on the attacker's own systems.
Online attacks against a login
MITRE ATT&CK T1110 covers brute force for when passwords are unknown or when password hashes have been obtained. Password guessing works through a list of likely passwords against an account. ATT&CK warns it can cause many authentication failures and account lockouts.
Password spraying (T1110.003) turns the pattern around. One password, or a small list, is tried against many different accounts to avoid the lockouts that would normally occur when brute forcing a single account. A password such as Winter2026! tried once against every account in a directory is spraying.
Credential stuffing (T1110.004) uses credentials from breach dumps of unrelated accounts and relies on people reusing passwords across sites.
Brute force also applies to devices. ATT&CK's lockscreen bypass technique (T1461) describes an attacker with physical access trying to brute-force or guess a phone's PIN. Vendors limit this with growing delays after failed attempts and an optional wipe after several failures.
Offline cracking and hash choice
Password cracking (T1110.002) recovers plaintext passwords from hashes the attacker has already stolen, by hashing guesses or using precomputed rainbow tables. ATT&CK says this usually happens on systems the attacker controls, outside the target network, so lockout policies do not apply.
CWE-916 explains why storage choice matters. Many hash algorithms are designed to run quickly, which lowers the cost of trying guesses. It recommends an adaptive function such as bcrypt, scrypt or PBKDF2 whose work factor can be raised, and says these are stronger than adding salts to a fast hash. A salt still helps: CWE-916 notes high computing overhead also makes rainbow table attacks infeasible.
Where the exam catches people
Believing spraying and brute force are the same: brute force hammers one account with many passwords; spraying spreads few passwords across many accounts to stay under lockout.
Believing account lockout stops cracking: cracking runs against stolen hashes on the attacker's own systems, so no login attempts reach the target.
Believing a unique salt makes a fast hash safe: CWE-916 says an adaptive function such as bcrypt, scrypt or PBKDF2 is stronger than salting a fast hash.
Believing credential stuffing guesses passwords: it reuses real pairs leaked from other breaches.