How does an attacker know when he has the password?

Question

An attacker gets a list of hashed passwords. How does he know when he has cracked the password(s)? He can't try millions of times on the comprised account.

Attacker gets hashed password. How does he know that "pAssword" is the correct password and not "passwoRd"?

EDIT:

I'm so missing something basic. Let me make certain I understand it:

1. The DBA takes my great password (pa$$word) and hashes it.
2. Attacker gets list of passwords.
3. Attacker tries "password." It gets hashed. He sees that hash-of-password does not equal my password. 3a. He tries hash-of-pa$$word. It gets hashed and he sees that the two are equal. Therefore he cracked my password.
4. After a while (x amount of time) he has cracked (say) 90% of the passwords and then stops because of diminishing returns. (Unless he really wants MY password.)

Answer 1

Yes, your steps appear to be correct. The attacker hashes lots of words or sequences of characters until she finds one which matches the target hash.

Pseudocode:

hashlist = [ "a235b8320c...", "688b4302c57f3...", ... ]
wordlist = file.readlines("/path/to/wordlist")
for each word in wordlist:
    h = hash(word)
    # is the hash of this word in the list of target hashes?
    if h in hashlist:
        print "Found: " + h + " = " + word

As muchaho requested, here's some pseudocode for how it'd work with unique salts:

hashlist = [ "salt1:a235b8320c...", "salt2:688b4302c57f3...", ... ]
wordlist = file.readlines("/path/to/wordlist")
for each h in hashlist:
    salt = split(h, ':')[0]
    h = split(h, ':')[1]
    for each word in wordlist:
        if hash(salt + word) == h:
            print "Found: " + salt + ":" + hash + " = " + word

Notice that, after adding a unique salt to each hash, we have to try each individual candidate word for each target hash, rather than just hashing all words and waiting for one to match a hash. This increases the bruteforce cost when you've got multiple hashes to crack, but most importantly prevents precomputation attacks such as rainbow tables.