What is a Brute Force Attack?
Brute Force Attack Definition:
A brute force attack is a method of gaining unauthorized access to an account, system, or encrypted file by systematically trying every possible password or credential combination until the correct one is found.
Rather than exploiting a software vulnerability, brute force attacks rely entirely on trial and error backed by automated tools and computing power. The name reflects the approach: overwhelming a target through sheer force of attempts rather than through skill or deception.
Brute force is one of the oldest attack methods in cybersecurity. It remains effective today because weak, short, and reused passwords are still common across individuals and organizations alike.
Types of Brute Force Attacks
Simple brute force tries every possible character combination in sequence, effective against short or numeric passwords such as PINs, but computationally expensive for longer ones.
Dictionary attack tests a pre-built list of common passwords, phrases, and previously leaked credentials. Far faster than pure brute force, and effective against the majority of real-world passwords.
Credential stuffing uses real username/password pairs stolen from prior data breaches. It succeeds because many users reuse the same credentials across multiple services.
Password spraying tries a small number of widely-used passwords (such as "Winter2024!") against a large number of accounts designed to stay under account lockout thresholds and avoid detection.
Reverse brute force fixes a known or commonly used password and iterates across many usernames. Often used to exploit default credentials on routers, enterprise devices, and IoT systems.
Hybrid attack combines dictionary words with rule-based mutations, appending numbers, capitalizing letters, and substituting characters to crack passwords that appear complex but follow predictable patterns.
What Attackers Target
Any credential-protected, publicly accessible service is at risk. The most commonly targeted include SSH and RDP endpoints, web application login pages, VPN portals, cloud identity providers (such as Microsoft 365 and Azure AD), and database services.
Why It Still Works
Brute force attacks continue to succeed not because they are sophisticated, but because they exploit consistent human habits at scale: short passwords, reused credentials, and services left exposed to the internet without additional authentication controls.
How to Stop It
The most effective single control is Multi-Factor Authentication (MFA); even a correctly guessed password cannot be used without the second factor. Supporting controls include account lockout policies, rate limiting on login endpoints, strong password requirements, and removing unnecessary internet-facing services.
Brute Force Attack vs. Related Terms
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Want the Full Technical Breakdown?
This page covers the definition. For detection methods, attacker tooling, indicators of compromise, SIEM correlation rules, and SOC response workflows, see the full guide:
→ Brute Force Attacks: Detection, Prevention & Response for SOC Analysts
Frequently asked questions
A brute force attack is guessing a password or key by trying many candidate values until one works. It does not exploit a software flaw, it uses the login or decryption process as designed, just automated to make thousands of attempts per minute. The defense is to make the number of required guesses impractically large or to require a second factor the attacker does not have.
A pure brute force attack tries every possible combination in the keyspace, which is exhaustive but slow. A dictionary attack only tries likely candidates from a wordlist of common and previously breached passwords, which is far faster against human-chosen passwords. A dictionary attack is a smarter, narrower form of brute force, and most real attacks use a dictionary or hybrid approach rather than pure exhaustion.
Credential stuffing replays full username and password pairs stolen from one breach against other services, betting on password reuse. Password spraying tries one common password against many different accounts to stay under per-account lockout thresholds. Stuffing exploits reused passwords, spraying exploits weak common passwords, and both are designed to look like normal logins rather than trip failure counters.
Brute force is MITRE ATT&CK technique T1110 under the Credential Access tactic. It has four sub-techniques: T1110.001 Password Guessing, T1110.002 Password Cracking, T1110.003 Password Spraying, and T1110.004 Credential Stuffing. The IDs let detections and incident reports describe the exact behavior consistently.
Look for failed-authentication spikes from one source (Windows Event ID 4625, Linux auth.log failures), waves of account lockouts (Event ID 4740), and a successful login immediately following many failures from the same source. Distributed attacks and credential stuffing produce few failures per account, so catch those with behavioral signals like impossible travel, unfamiliar devices, and logins from new locations.
Multi-factor authentication is the single most effective control, because a guessed password is useless without the second factor. Layer it with rate limiting and account lockout, strong salted and slow password hashing (bcrypt, scrypt, or Argon2) to defeat offline cracking, breached-password checks, CAPTCHA challenges, and ideally passwordless authentication that removes the guessable secret entirely.