Password attack planning