SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-credential-stuffing

Trying stolen username and password pairs from one breach against other websites is called what?

Credential stuffing, because people reuse passwords.

Start playing free

  1. Password spraying
  2. Credential stuffing ✔
  3. Pass the hash

Why: Attackers automate logins with breached pairs. It works because many people use the same password on several sites; unique passwords and MFA stop it.

Huh, didn't know that: OWASP defines it as the automated injection of stolen username and password pairs into login forms.

The dad joke
My email password has been hacked. That's the third time I've had to rename the cat.
Like this card?
Play the game

References

Answer: Credential stuffing. Attackers automate logins with breached pairs. It works because many people use the same password on several sites; unique passwords and MFA stop it.

  1. OWASP, Credential stuffing owasp.org/www-community/attacks/Credential_stuffing
    Credential stuffing is the automated injection of stolen username and password pairs (“credentials”) in to website login forms
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich web attack inserts a database query into an input field that the application then runs?Security & PrivacyWhich web attack injects malicious scripts into otherwise trusted websites so they run in other users' browsers?Security & PrivacyWhich attack forces a logged-in user's browser to perform an action they did not intend?

That's stuff everyone should know.