Brute Force

Brute force means trying many combinations (passwords, PINs, tokens, paths) until hitting the valid one. It is noisy and, done well, targeted: you rarely try "the whole space"; you almost always start from a sensible candidate list and from an observation that tells you when you got it right.

Its forms.

• Dictionary. Trying a list of common passwords (rockyou.txt). The most common and cost-effective.
• Password spraying. A single likely password against many users, to avoid lockouts. Useful after a username enumeration.
• Pure brute force. Generating combinations by length and character set. Only viable for short secrets or PINs.
• Rules and mutations. Applying transforms to a wordlist (hashcat --rules, cewl to build lists from the site itself).

The oracle: knowing when you hit. What matters is not firing requests but telling success from failure. On the web you filter by status code, length or redirect (wfuzz --hh/--hc, ffuf -fc/-fs); against services, the tool handles it (hydra, netexec). Without a clear oracle, brute force is blind.

hydra -L users.txt -P rockyou.txt <ip> ssh
hydra -l <user> -P rockyou.txt <ip> http-post-form '/login:user=^USER^&pass=^PASS^:F=incorrect'
netexec ssh <ip> -u users.txt -p rockyou.txt
medusa -h <ip> -U users.txt -P rockyou.txt -M ssh
wfuzz -u 'http://<host>/login' -d 'user=<user>&pass=FUZZ' -w rockyou.txt --hh=<len>
ffuf -w rockyou.txt -u http://<host>/login -X POST -d 'user=<user>&pass=FUZZ' -fc 401

Online vs offline. Online (against a live service) is slow and hits lockouts and rate limiting. Offline (against an already captured hash, with hashcat/john) is far faster and leaves no trace on the target: that is why stealing the hash and cracking it is usually preferable.

Lab vs real-world considerations. In a CTF there are no account lockouts or alerts; in the real world, a lockout policy, MFA, CAPTCHA or rate limiting can stop the attack cold or expose the attacker. Check those defences before launching.

How to detect it. Online brute force is one of the most detectable techniques: many failed attempts in a short time from one source against an account or endpoint. Each service leaves its trace: SSH, bursts of Failed password in /var/log/auth.log; Windows, a flood of Event ID 4625 (and 4771/4776 on the DC); web, a spike of 401/403 or login POSTs with the same response length. The classic detection countermeasure is a failure counter per IP/account (fail2ban, SIEM rules). Watch for the late success: a valid 4624/200 after the burst flags the compromised account. The offline variant (against a stolen hash) is undetectable on the victim: there the signal is the prior theft of the hash (see hash cracking).

Defence. Long, unique passwords; MFA; progressive lockout and rate limiting; CAPTCHA on sensitive forms; uniform responses so you do not act as an oracle; store hashes with slow algorithms (bcrypt, argon2). Related to username enumeration and, in domains, to Kerberoasting.