Brute force attacks: How they work and how to stop them

What a brute force attack is

A brute force attack works through possible values for a secret until the right one turns up. It trades time and compute for cleverness. That makes it slow, and it also makes it work against anything with a weak secret and no attempt limit.

What the term means

Brute force is trial and error at machine speed. The attacker points an automated tool at a login form, a hash dump or an encrypted file and lets it run through guesses until one succeeds. There is no exploit involved, only persistence, and against a poorly protected system persistence is enough.

Common targets

Passwords, API keys and encryption keys open the door to accounts, services and data, which is why they are what attackers guess.

1. Passwords are the most common target. Tools start with common passwords and dictionary words, so short, lowercase-only or pattern-based passwords fall first.
2. API keys authenticate requests between applications. A guessed key lets the attacker read data, change it or run commands, and an API without rate limiting makes the guessing cheap.
3. Encryption keys get tried one after another until the data decrypts. Each extra bit of key length doubles the work, so short keys are the ones at risk.

How brute force attacks work

Every brute force attack has three steps.

1. Pick a target: a login page, a database, an encrypted file. The attacker learns what they can first, such as the username format and the password policy, because it shrinks the search.
2. Generate guesses, from a list of common passwords up to every combination of letters, digits and symbols.
3. Test each guess against the target. If nothing blocks repeated attempts, the tool runs until it hits. Rate limits, CAPTCHAs and lockouts are what slow it down or stop it.

Types of brute force attacks

Six variants cover almost everything you will see in your logs.

1. Simple brute force: every possible combination of characters, in order, with no prior knowledge of the target. One computer, or even a phone, is enough to run it.
2. Dictionary attack: a precompiled list of common words, phrases and leaked passwords instead of every combination. The lists run to millions of entries, which makes this far faster than pure brute force.
3. Hybrid attack: dictionary words with variations added, such as digits or symbols on the end of a common word, to catch passwords that are a little more than a dictionary word.
4. Credential stuffing: credentials stolen from one site, replayed against others. It works because people reuse passwords; the attacker is not guessing, only checking.
5. Reverse brute force: one or a few weak passwords ("123456", "password") tried against many usernames. Attackers use it against large credential databases to open many accounts at once.
6. Password spraying: a handful of common passwords tried across many accounts, slowly, to stay under lockout thresholds. It works best when the attacker knows the target's password policy.

Why brute force still works

Three properties keep brute force in use.

1. It is simple. No exploit and no knowledge of the target's internals: download a tool, point it, start.
2. It applies everywhere. Anything that authenticates, from a website to an SSH port to an encrypted archive, can be brute forced, whatever the platform.
3. It is reliable given time. Run long enough without interference, an exhaustive search will find the secret. The only question is whether a defender stops it first.

Where brute force breaks down

Its weaknesses are the ones you design defenses around.

1. Time. Every extra character multiplies the search space, so past a certain length the attack is impractical even with a botnet behind it.
2. Complexity. Mixing upper and lower case, digits and symbols raises the number of candidates per position. A six-character lowercase password has 26^6 combinations, about 308 million.
3. Length. Each added character multiplies the work again. An eight-character password drawn from 94 characters has 94^8 combinations; a twelve-character one has 94^12, many orders of magnitude more.

Brute force attack tools

Attackers and penetration testers use the same tools. Most run dictionary, hybrid and exhaustive modes and split the work across CPUs, GPUs or several machines.

The ones you will meet most often:

1. Aircrack-ng: cracks WEP and WPA/WPA2-PSK wireless networks and doubles as a packet sniffer and wireless reconnaissance tool.
2. DaveGrohl: a multithreaded cracker that runs dictionary and custom string attacks.
3. Hashcat: open-source password recovery that supports over 200 hash algorithms and uses GPU acceleration to crack hashes at high speed.
4. THC Hydra: one of the fastest online crackers, with dictionary and brute force modes against SSH, FTP, SMB, RDP and many other services.
5. John the Ripper: cracks password hashes with dictionary, hybrid and mask modes driven by user-defined rules.
6. L0phtCrack: a Windows password auditing and recovery tool that cracks NTLMv1 and NTLMv2 hashes and can spread the work across several machines.
7. NL Brute: a simple tool with dictionary, brute force and hybrid modes, also used for password spraying across a network.
8. Ophcrack: cracks Windows passwords from rainbow tables; it runs from a live CD or as an installed program.
9. RainbowCrack: an open-source hash cracker for LM and NTLM hashes that uses precomputed rainbow tables, which you can generate for different character sets and lengths.

What attackers do with the access

A brute forced login is a means, not an end. Four outcomes show up most.

Harvesting and selling data

Attackers use a compromised site or account to push ads and to collect what users type: login credentials, card numbers, personal details. Botnets and keyloggers do the collecting, and the data is sold on.

Personal data theft

Social platforms and ecommerce accounts hold a lot of personal information. Once an attacker has working credentials, bank accounts, email and private messages are one login away.

Spreading malware

A brute forced server or device is a foothold. The attacker installs malware that gives them control, then uses that control for ransomware or adds the machine to a botnet for DDoS.

Taking a site down

A flood of login attempts is also a denial of service. It eats server capacity, triggers lockouts on real accounts and leaves customers unable to sign in. For a business that sells online, that is lost revenue and lost trust.

Protecting against brute force attacks

Five controls stop almost all of it. None of them is new.

Password length and complexity

Require length first, then a mix of character types. Ban the obvious choices: dictionary words, birth dates, sequences, and anything that appears in known breach lists. Do not let people reuse a password across accounts, because reuse is what credential stuffing feeds on.

Limiting failed login attempts

After a few failures, slow the account down or lock it for a while, and count failures per IP address as well as per account. Prefer growing delays over hard lockouts where you can, because an attacker can turn a hard lockout into a denial of service against your own users.

Hashing passwords properly

Encryption is reversible with the key; hashing is one way. Store passwords as salted hashes produced by a slow function built for the purpose, such as bcrypt, scrypt or Argon2. If the database leaks, the attacker then has to brute force every hash offline, and the salt and the slow function make that cost real.

CAPTCHA on the login form

A CAPTCHA asks the client to do something scripts find hard, such as picking out images or typing distorted text. Solving services exist, so it will not stop a determined attacker, but it removes the cheap high-volume attempts and adds friction to the rest.

Two-factor authentication (2FA)

2FA asks for something beyond the password: a code from an app, an SMS, a hardware key, a fingerprint. A guessed password then brings the attacker to a second gate they cannot pass by guessing.

Real-world examples of brute force attacks

Brute force is old and still in the news. Four cases come up in every round-up.

1. Ticketmaster (2018): a breach affecting over 40,000 customers that entered through a chatbot on the company's customer support pages. Once inside, the attackers could reach personal and payment information held in that system.
2. University of Cambridge (2020): in February 2020 the university's security team saw large numbers of failed logins against its website from many IP addresses and treated it as an organized attack. No sensitive data was reported compromised, but it showed how exposed a public login is.
3. LinkedIn (2012): over 6 million user passwords leaked from LinkedIn's database. Lists like this one are what dictionary and credential stuffing attacks are built from.
4. VPNs and firewalls: Cisco has warned about brute force campaigns against VPN services and firewalls, including OpenVPN, and advised limiting outbound connections from VPN services and restricting access to unprivileged accounts.

Where Sensfrx fits

Rate limits and lockouts catch the loud attacks. The quiet ones, spraying a few passwords across thousands of accounts from rotating IPs, stay under every per-account and per-IP threshold.

Sensfrx scores each login attempt from device, network and behaviour signals, so the pattern shows up even when no single counter trips: the same device behind many usernames, a datacenter or proxy network, interaction timing that is not a person.

Your rules turn the score into an action: allow, send to review, or block. A customer logging in from their usual phone never notices; a spraying run from a hosting provider range hits a block rule.

The same score runs on signups and payments, so an account that was taken over and then used to buy is caught at checkout too. See account takeover protection for how the login scoring works.

What to do first

Brute force is not clever, which is why it is still here: it needs only a weak secret and an unlimited number of tries.

Take away the tries first. Put failure limits and growing delays on login and password reset, add a CAPTCHA once failures climb, and turn on 2FA for staff and high-value accounts. Then fix storage: salted, slow hashes, so a leaked database does not become a credential list.

Then watch the attempts you are blocking. The attacker who notices the limit does not leave; they slow down and spread out, and that is what login scoring is for.

Frequently asked questions