Learn in the textbookAttacks Targeting Passwords and Authentication
DefinitionA password list attack (パスワードリスト攻撃) uses a list of ID–password pairs leaked elsewhere to try logging in to a different site.
ExplanationThe attacker does no guessing and simply enters pairs that were actually in use. Damage spreads because a pair leaked from one site also works on any other site where the same pair is registered.
AnalogyIt is like someone who opens their house, car and locker with one key: if they drop it, whoever picks it up can open all three.