What is Brute Force Attack?

Attacks range from simple (trying every character combination) to sophisticated (credential stuffing with breached username/password pairs from previous data breaches). Password spraying tries a single common password against many accounts to avoid lockout thresholds.

Modern attacks are automated using Hydra, Medusa, and custom scripts, with rates calibrated to target lockout thresholds. Spraying one password per account per hour avoids lockouts while testing thousands of accounts per day. Cloud services are particularly targeted because they often lack the same rate-limiting as on-premises systems and are globally accessible.

Online brute force targets a live authentication endpoint (SSH, RDP, a web login form, an API) and is throttled by network round-trip time and any lockout or rate-limiting on the target. Offline brute force works against a stolen password hash or encrypted file with no rate limit at all: the attacker has already exfiltrated the hash (from a dumped SAM database, an NTDS.dit file, or a leaked website database) and cracks it locally with tools like hashcat or John the Ripper, often accelerated with GPU clusters that test enormous numbers of candidate passwords per second against unsalted or weakly hashed values.

Credential stuffing differs from classic brute force in that it does not guess: it replays username/password pairs harvested from unrelated data breaches, exploiting the fact that many users reuse passwords across services. A single breached password list can be tested against dozens of unrelated logins (banking, email, corporate SSO) using tools like OpenBullet, often routed through residential proxy networks to distribute requests across many IPs and evade IP-based rate limiting.

Password spraying flips the usual pattern: instead of many passwords against one account, it tries one or a handful of common passwords (a current season plus year, a default vendor password) against every account in a directory, staying under per-account lockout thresholds while still statistically catching users with weak passwords. It is especially effective against externally-exposed services like Office 365 or VPN portals that lack adaptive, risk-based lockout.

Defenses include: account lockout policies, MFA (rendering password compromise insufficient), adaptive authentication, rate limiting, CAPTCHA, and monitoring for authentication anomalies. Threat intelligence about compromised credentials from data breaches should drive proactive password resets.