What is a dictionary attack?
A dictionary attack is password guessing that starts from a curated list rather than from every possible string. The name comes from the word list, or dictionary, the attacker feeds the tool: common passwords, words from a language, names, and above all passwords exposed in past breaches. It is the practical middle ground between a slow pure brute-force search and a lucky single guess, and in practice most passwords that do get cracked fall to a dictionary with rules rather than to pure brute force.
Why a list beats raw brute force
A pure brute-force attack tries every combination of characters and is guaranteed to succeed eventually, but the search space grows so fast with length that most passwords are out of reach. People, however, do not pick random strings. A dictionary attack exploits that by testing only the choices humans actually make. A hybrid attack extends the list with brute-forced endings, appending digits, a year or a symbol to each word.
Rules turn one word into thousands
Modern crackers apply transformation rules to every entry in the list. A single base word becomes dozens of variants through predictable substitutions and additions, so a tool can test an entire breach corpus mangled in common ways. A leaked list of real human passwords is the most valuable dictionary of all, because it captures exactly the patterns a complexity policy pushes people toward.
Online versus offline, and the defenses
Against a live login, the attempts are limited by the service: account lockout, throttling, rate limits and multifactor authentication all slow or stop them, and every try is logged. Against stolen password hashes the guessing moves to the attacker's own hardware, where none of those controls apply and only the storage matters. There, a unique salt per account defeats reuse of precomputed results and a deliberately slow hashing algorithm limits guesses per second. Banning known-weak and breached passwords removes the exact entries a dictionary relies on.
Dictionary attack on the CompTIA Security+ exam
A dictionary attack is a credential-attack indicator under SY0-801 objective 2.5. Scenario wording about a word list, leaked-password file, or rule-based guessing points here. Distinguish it from a pure brute-force attack, which tries all combinations, and from password spraying, which tests one common password against many accounts to dodge lockout. When the target is a stolen hash file, the winning defenses are salting and a slow hash, not lockout, which cannot touch offline guessing. The same attack also appears in A+ Core 2 (220-1202) objective 2.5.