I have been learning metasploit. One thing I noticed was that, all the videos on YouTube, which said "Brute forcing", used a password and a username list. My question is that, won't this be called a dictionary attack instead? Because as far as I know, brute forcing actually generates a password or a string and checks it.

4 Answers 4


A "dictionary" attack is a subset of a "brute force" attack. You are still trying every item in a list to see if it works, and that makes it "brute force". Another type of brute force, of course, is to permute all characters and lengths.


A dictionary attack only defines the scope of a brute force attack. It means that instead of generating the passwords or usernames, they have been pre-generated in a file, and you should use those instead of wasting CPU cycles on generating passwords and checking if it has been generated before. So No, it is still a brute force attack.

In fact a lot of brute force attack programs and libraries still allow for three types of dictionaries: Username dictionaries, password dictionaries, and combination dictionaries of a username and password combination.

Because it is still entering every possible combination in it's scope and trying them until one works, it is still a brute force attack.

  • what if the actual password or the username is not in the dictionary? Sep 27, 2015 at 16:06
  • Depends on the program or library. Some will ask if you want to fall back to generating usernames and passwords, some will ask if you want to use another dictionary, some will just exit. It depends on how it was programmed. Sep 27, 2015 at 16:31

Technically, brute forcing means trying a subset of a set of elements in order to bypass a form of access control, without taking into account the feedback of the form of control, as in the approach doesn't change as it would in the context of a timing attack. Passwords are attempted either until a match is found or the dictionary is exhausted.

Dictionary attacks are meant to speed up the process by skipping, possibly wrong, sequences of characters in favour of ones which are more likely to be remembered; words and/or sequences of words(i.e. pass phrases).

For example x&(fsb}@ is more difficult to remember than question thus the word question is more likely to be used as a credential.

If you want to generate all permutations of n characters, using m characters you would come up with a set of m ^ n elements.

For example if we have a set of characters {'a', 'b'} and we would like to generate all length 2 passwords using these characters we would come up with:


a set of cardinality of 4. Similarly if we would like to increase the length to 3 we would come up with the following set:


a set of cardinality 8.

The English dictionary currently has around 171476 words far fewer than all characters of length 6, for example.

  • I don't think I agree with any point that you have made in this answer. Do you have any sources to back up these statements?
    – schroeder
    Sep 25, 2015 at 17:02
  • @schroeder On which point you do not agree? Yes, which one should I clarify?
    – Sebi
    Sep 25, 2015 at 17:04
  • Literally all of them. Brute forcing has to take into account the feedback from the form (else how would it know that it succeeded?). Dictionary attacks have nothing to do with what is "most likely to be remembered" but more generally, what set is more likely to succeed. Dictionary attacks can make use of dictionary words, but that is not generally true. The string x&(fsb}@ is a perfectly valid entry in a dictionary, depending on the character space being tested. The number of words in the English dictionary is 1,025,109.
    – schroeder
    Sep 25, 2015 at 17:09
  • @schroeder I've meant to say that it works exhaustively simply trying all entries until a valid password is reached or the dictionary itself is exhausted, but it doesn't work like a cryptographic timing attack, as in doesn't change the approach depending on the received output. x&(fsb}@ does not constitute a meaningful word in the English language as in it's not in the dictionary. I was referring to words in current use. Source: oxforddictionaries.com/words/…
    – Sebi
    Sep 25, 2015 at 17:14

In addition to the correct answers so far, not only is a dictionary attack a subset or specific type of brute-force, the two are also typically used together in a real attack scenario.

You would lead with a dictionary attack to check for the most common and most likely usernames and/or passwords early, instead of finding that the password was "password" all along but you started with "aaaaaaaa".

Then, if your dictionary attack is unsuccessful, you would switch to permutated dictionary attacks (typical character exchanged, added numbers, etc.)

And if that fails as well, then you go and do a true brute-force attack, excluding those strings you already tested.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .