Brute Force Attacks
How a Brute Force Attack Works
A brute force attack is a method of gaining access to an account by trying a large number of possible passwords until one of them works. The attacker does not need any prior knowledge of the password, because automation does the guessing.
Attackers use scripts that send login requests to a target at high speed. Each request contains a username and a guessed password, and the script records which attempts succeed. Modern tools can test many combinations per minute and spread requests across many IP addresses, which helps them avoid simple rate limits.
The guesses are not random. Attackers start with common passwords, short words with numbers added, and default credentials that software ships with. They move on to longer lists only when the short ones fail. Attackers who already hold leaked passwords use a related method, credential stuffing, described separately.
Which Logins Attackers Target Most Often
Any service with a login page or a remote access port can be a target. For website owners, the most common targets include:
- CMS admin pages, such as the login screen of a content management system. A successful login gives full control of the site.
- Hosting control panels, which manage files, databases and email for the whole account.
- SSH, the encrypted command-line access to a server.
- FTP, the file transfer login. Plain FTP sends passwords without encryption, so it is a weaker choice than encrypted alternatives.
Default usernames such as admin make the job easier, because an attacker only has to guess the password. Login addresses that are the same on every site also tell automated tools exactly where to aim.
Why Weak Passwords Fall Quickly
The number of possible passwords grows very fast as length and variety increase. A short password made only of lowercase letters has far fewer combinations than a long one that mixes letters, numbers and symbols. Short, predictable passwords are the ones attackers reach first.
Online attacks against a live login page are limited by the speed of the server and the network, because each guess has to be sent and answered. That is one reason servers often limit failed attempts, sometimes with tools such as Fail2ban. Even so, a weak password on a common list can be found quickly, while a long, unique password is usually out of reach.
Frequently asked questions
Can a strong password stop a brute force attack?
In most cases, yes. A long, random and unique password makes guessing impractical, because the number of possible combinations is too large to test. Strong passwords do not stop the attempts themselves, which still create load and log entries. Two-factor authentication adds a second barrier if a password is ever guessed.
What does a brute force attack look like in server logs?
It usually appears as a large number of failed login attempts in a short period. The attempts often target the same login page or a short list of usernames, and they may come from one address or from many. A few failures are normal, but hundreds of failed logins within minutes is a strong sign of automated guessing.