Brute force attacks: guessing until something works

Definitions follow OWASP and CWE-307.

The attacker picks a target, usually a username, and sends sign-in attempts with different passwords. Each attempt is an ordinary request; what makes it an attack is the number of them and the fact that almost all fail.

Pure brute force tries every combination and is slow against any password of reasonable length. Real attacks are smarter about which passwords to try first, which is why the variants below matter more than the textbook definition.

• Dictionary attack. Tries likely passwords first: common words, leaked password lists and their usual variations.
• Password spraying. Tries one or a few common passwords against many accounts, staying under per-account limits.
• Credential stuffing. Tries username and password pairs leaked from other sites; see credential stuffing.
• Reverse brute force. Starts from one known password and looks for an account that uses it.

The difference decides what catches them. Attempts concentrated on one account show up in per-account counts; spraying and stuffing show up only in totals per source and in the ratio of failures to successes.

A burst of failed sign-ins is the obvious sign. The quieter signs matter more: a steady rate of failures across many accounts, failures from hosting ranges rather than from homes and phones, usernames that do not exist on your site, and a success that follows a long run of failures from the same source.

That last pattern deserves an alert of its own. A success after many failures is a likely compromise, and the account should be checked before its owner notices.

Brute force succeeds because people reuse and choose predictable passwords, and because many sign-in forms answer an unlimited number of attempts at full speed. Lists of leaked passwords give attackers the likely guesses first, so a weak password falls in minutes, not years.

Each part of that is fixable. Limits remove the unlimited attempts, breached-password checks remove the likely guesses, and a second factor makes a correct guess insufficient on its own.

1. Add a second factor. Multi-factor authentication defeats a guessed password; the OWASP Authentication Cheat Sheet puts it first.
2. Throttle failed attempts. Slow down or delay after failures without hard lockouts. NIST SP 800-63B section 5.2.2 sets a ceiling of 100 consecutive failed attempts per account and lists ways to avoid locking real users out.
3. Limit per source as well as per account. Spraying and stuffing stay under per-account limits; choosing the subject of a limit explains the trade.
4. Refuse known-bad passwords. Check new passwords against breached and common password lists.
5. Answer every outcome the same way. Identical responses for wrong user and wrong password stop attackers from learning which usernames exist.

Hard lockout is the measure to use carefully: anyone who knows a username can then lock its owner out on purpose. CAPTCHA is one way to slow attempts; it costs real users, so it belongs after other signals, not on every sign-in.

The same attack runs against remote-access services such as SSH and remote desktop. Those connections never reach a web application, so a request filter does not see them; they are protected with keys instead of passwords, network restrictions and the service's own attempt limits.