Which attack uses a predefined set of rules to mutate or generate password guesses from common words?

• A. Dictionary Attack
• B. Brute Force Attack
• C. Rule-based Attack
• D. Rainbow Table Attack

Answer: (C)

Rule-based attacks rely on a predefined set of transformation rules that alter words from a base dictionary to create many password guesses. The core idea is that people often derive passwords by applying common patterns to simple words, such as capitalizing the first letter, substituting letters with similar-looking numbers or symbols, adding digits at the end or in the middle, or mixing cases. By applying these rules to each word in a wordlist, an attacker can generate a large set of plausible candidates that stay close to real words while reflecting typical user behaviors. This approach is more efficient than trying every possible string (brute force) and more targeted than a plain dictionary attack, which checks words exactly as listed without mutations. It also differs from a rainbow table, which relies on precomputed hash lookups for specific inputs rather than systematically mutating base words with rules.