It's passive observation of a successful authentication session. This may occur if the victim performs authentication over a network where you can observe the a

It's passive observation of a successful authentication session. This may occur if the victim performs authentication over a network where you can observe the authentication traffic (even though it is encrypted in transit), or if you can inject a timing script that can observe when authentication starts and finishes, or if you can gain access to logs of the server performing the password check (containing at minimum e.g. IP addresses and timestamps).