What is love? Baby don't brute me!

Hi, Ցանցահենы

Brute force is one of the oldest tricks in the book. It's old. It's dumb. It absolutely still works, and that says more about us than it does about the attack.

What Is a Brute Force Attack?

Imagine you lost your bike lock combination. A smart person would try to remember it. A brute force attack is the guy who just starts at 0000 and works his way up.

That's it. That's the whole concept. Try everything until something works.

The reason it's still relevant in 2026 isn't because attackers are smart. It's because users are predictably bad at passwords and defenders are often worse at rate limiting (WordPress is being brute forced most of the time, and its often successful).

Types of Brute Force Attacks

1. Pure / Simple Brute Force

aaa → aab → aac → ... → zzzzzzzzzz

This is the caveman of the family. Tries every possible combination of characters in sequence. Against a long, random password it'd take longer than the heat death of the universe. Against tim123? Give it a minute.

2. Dictionary Attack

Why guess randomly when people keep using hitler, Alfredthebuttler and password? A dictionary attack skips the math and goes straight for human laziness. Load up rockyou.txt. 14 million real passwords leaked from real breaches.

The uncomfortable truth: most passwords aren't passwords, they're vocabulary words with a number slapped on the end.

3. Hybrid Attack

Dictionary + mutations. You take a wordlist and run it through mutation rules: capitalize the first letter, swap a for @, stick a ! at the end, add the current year. password becomes P@ssw0rd2024! in about four rule applications.

Hashcat's rule engine is terrifyingly good at this. People who think they're being clever with their substitutions are not being as clever as they think.

4. Credential Stuffing

This one isn't really about guessing at all. It's about copying other people's homework. Someone breached LinkedIn in 2012, another company in 2016, another one last Tuesday. Those credentials get compiled, sold, and thrown at every major service on the internet.

It works because the average person uses the same password on 4–5 sites. One breach = five accounts.

This is why your company's IT policy keeps nagging you about unique passwords and why you keep ignoring it.

Sites like HaveIBeenPwned exist for a reason, but who cares if their pass is pwned anyway?

5. Reverse Brute Force

Regular brute force: one account, many passwords.

Reverse brute force: one password, many accounts.

Pick 123456, try it against a million usernames. Even with a 0.1% success rate, that's 1,000 valid logins. Per-account lockout policies don't help you here. Nobody's hitting the lockout threshold, because no account gets more than one or two attempts.

6. Rainbow Table Attack

Imagine someone did all the brute force work in advance, stored the results in a giant lookup table, and now can crack a hash in milliseconds instead of hours. That's a rainbow table.

The defense is salting (adding a random value to each password before hashing so two identical passwords produce completely different hashes. No precomputation survives that. This is why properly salted hashes aren't in rainbow tables and why any developer still storing unsalted MD5 passwords in 2026 should be gently escorted out of the building.

7. Password Spraying

Instead of hitting one account hard and fast, password spraying tries a small number of common passwords across a massive number of accounts, slowly, with long gaps between attempts.

It's designed specifically to fly under lockout thresholds. Three attempts per account, spread over hours or days? Most security tooling won't even blink. APT groups love this against enterprise Active Directory environments and it works embarrassingly often.

The Toolbox

Here's what's actually used out in the wild for pentesting, CTFs, and red team engagements.

Network / Login Brute Forcing

Password / Hash Cracking

Web Application

Wireless

Wordlists Worth Knowing

• rockyou.txt - 14 million real passwords from a real breach. The foundation of any wordlist setup

• SecLists (Daniel Miessler) - covers usernames, passwords, directories, fuzzing payloads. Bookmark it now

• CeWL - crawls a target website and builds a wordlist from its content. Surprisingly effective against companies that name everything after their own products

• Mentalist / CUPP - profile-based generation. You know someone's dog's name and birthday? CUPP knows what to do with that

Defenses (The Defender's Playbook by me)

Understanding the attack is step one. Here's how you stop it:

Account-Level Controls

Account lockout - lock an account after N failed attempts. Effective but blunt; aggressive lockout thresholds are a free DoS vector against your own users. Tune carefully.

Rate limiting - cap login attempts per IP, per account, per time window. More surgical than lockout and harder to abuse.

Progressive delays - exponential backoff on failed logins. First failure: instant. Second: 1 second. Fifth: 30 seconds. Tenth: good luck. No lockout, no DoS risk, and automated tools hate it.

CAPTCHA - the one everybody hates, including the developers who implement it. Still effective against basic automation. Less effective against motivated attackers with solving services, but it raises the bar.

Authentication Hardening

MFA everywhere, no exceptions - if a set of credentials is compromised, a second factor is the difference between "account accessed" and "credentials leaked but nothing happened." This single control neutralizes credential stuffing almost entirely.

Passkeys - increasingly mature and increasingly worth pushing to users. Cryptographically immune to password spraying by design because there's no password to spray.

Length over complexity - a 16-character passphrase is astronomically harder to crack than P@ssw0rd! and easier for humans to remember. Stop requiring special characters and start requiring length.

Block known-breached passwords - HaveIBeenPwned exposes an API. Check new and changed passwords against it. If 123456 or batman2020 is in the breach corpus, reject it at the door.

Infrastructure & Monitoring

Geo/IP blocking - if your entire userbase is in one country and you're suddenly seeing auth attempts from forty different countries simultaneously, that's not organic traffic.

Fail2Ban / ModSecurity - auto-banning IPs after threshold breaches. Not a silver bullet. Attackers rotate IPs. But it raises costs.

SIEM alerting on 401 spikes - a sudden surge in failed auth events is almost never innocent. This alert should exist in every environment and it often doesn't.

Honeypot accounts - create accounts that have no legitimate users. Document them, lock them up, and alert on every single auth attempt. Any hit is by definition malicious, zero false positives.

For Developers: Hash It Properly

Salt every password - a random salt per user before hashing destroys rainbow table attacks. Not optional.

Use bcrypt, Argon2id, or scrypt - these are slow by design. The slowness is a feature. Argon2id is the current recommendation.

Stop using MD5 and SHA1 for passwords (PLEASE) - these are general-purpose fast hashing algorithms. Fast is the exact wrong property for a password hash.

Quick Reference: Attack vs. Defense

Final Thoughts

Brute force is not sophisticated. It's the digital equivalent of trying every key on a keyring. The reason it keeps working, decade after decade, is not because attackers are clever, it's because the basics of authentication hygiene are still being ignored at scale.

Fix three things and you solve most of it: stop reusing passwords, use MFA, and hash properly. That's genuinely it. The attack that's been around since the dawn of computers becomes nearly irrelevant.

Happy hacking.