A brute force attack is a trial-and-error method used by attackers to guess passwords, encryption keys, login credentials, or API tokens by systematically trying every possible combination until the correct one is found. Brute force attacks can be automated using tools like Hydra, John the Ripper, Hashcat, and Medusa. Attackers use dictionary files (wordlists), character sets (a-z, A-Z, 0-9, symbols), and rainbow tables to crack passwords. Brute force attacks target: login portals (SSH, RDP, FTP, HTTP Basic Auth), password hashes (MD5, SHA1, bcrypt), encrypted files (ZIP, RAR, PDF), and API endpoints (rate-limited).
Attack Statistics: 80% of data breaches involve weak passwords vulnerable to brute force. Average password cracking time for "password123": 0.5 seconds. 16-character random password: 100+ years. 50% of organizations experience brute force attacks monthly (Verizon DBIR).
Common brute force targets:
Most common brute force method. Uses wordlist of common passwords (rockyou.txt, SecLists). Faster than pure brute force (millions of passwords vs billions). Success rate: 60-80% against weak passwords.
Tries every possible combination (a-z, A-Z, 0-9, symbols). Time increases exponentially with password length. 8-character alphanumeric: 218 trillion combinations. Infeasible for long passwords (12+ characters).
Combines dictionary words with mutations (append numbers, substitute characters). Example: "password" → "password123", "Password!", "P@ssw0rd". More effective than pure brute force.
Attacker has a known password (from breach) and tries it against multiple usernames. Bypasses account lockout policies (distributed across accounts).
Uses username/password pairs from previous data breaches (HaveIBeenPwned). Highly effective due to password reuse (60% of users reuse passwords).
// Hydra SSH brute force attack
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100
// Hydra FTP brute force
hydra -L users.txt -P passwords.txt ftp://192.168.1.100
// Hashcat (password hash cracking)
hashcat -m 0 -a 0 md5_hash.txt rockyou.txt
// Medusa (parallel brute force)
medusa -h target.com -u admin -P passwords.txt -M http -m GET:/login
// Ncrack (RDP brute force)
ncrack -U users.txt -P passwords.txt rdp://192.168.1.100
// Wordlist size examples (rockyou.txt): 14 million passwords
// SecLists/Passwords: 1 billion+ passwords (rockyou2021.txt)
Fast network login cracker. Supports 50+ protocols (SSH, FTP, HTTP, RDP, SMB, MySQL, PostgreSQL, SMTP, POP3, IMAP, Telnet, Cisco, VNC). Parallel attacks (16-64 threads).
Password hash cracker. Supports MD5, SHA1, SHA256, bcrypt, NTLM, DES, MySQL, PostgreSQL, Unix crypt. Wordlist mode, incremental mode, rule-based mutations.
World's fastest password cracker using GPU (NVIDIA CUDA, AMD OpenCL). Cracks MD5 at 100 billion hashes/sec (8x RTX 4090). Supports 300+ hash types.
Parallel brute force tool. Supports HTTP, FTP, SSH, Telnet, SMTP, POP3. Faster than Hydra for some protocols.
// Brute force statistics (2023-2024)
- 80% of data breaches involve weak passwords (Verizon DBIR 2023)
- 60% of users reuse passwords across multiple accounts
- Average password cracking time for "password123": 0.5 seconds (hashcat)
- 16-character random password (a-z, A-Z, 0-9, symbols): 100+ years
- 50% of organizations experience brute force attacks monthly
- 30% of SSH servers have weak passwords vulnerable to brute force
- 40% of RDP attacks are brute force (ransomware entry vector)
- 85% of brute force attacks use dictionary attacks (rockyou.txt)
- Average attacker success rate: 1% per 1000 attempts (depends on password strength)
// Password cracking speeds (hashcat, 8x RTX 4090)
- MD5: 100 billion hashes/sec
- SHA1: 30 billion hashes/sec
- NTLM: 50 billion hashes/sec
- bcrypt (cost 5): 200k hashes/sec
- bcrypt (cost 12): 5k hashes/sec
This demonstration simulates a brute force attack trying password combinations:
This is a simulated demonstration. Real brute force attacks can crack weak passwords in seconds. Protect yourself with MFA, strong passwords (16+ random characters), account lockout policies, and rate limiting.
High volume of failed logins (10+ per minute) from same IP address indicates brute force. Monitor SSH logs (/var/log/auth.log), web server logs (HTTP 401/403), Windows Event Logs (Event ID 4625).
Fail2ban monitors logs and blocks IPs with repeated failed attempts (iptables, firewall). Custom jails for SSH, Apache, Nginx, Postfix, vsftpd.
Detect SSH brute force: multiple connection attempts, high rate of AUTH_FAILED. RDP brute force: Event ID 4625 (logon failure).
MFA blocks brute force attacks (password alone insufficient). Use TOTP (Google Authenticator), hardware tokens (YubiKey), or push notifications (Duo).
Lock account after X failed attempts (5-10 attempts). Lockout duration: 15-30 minutes. Prevents unlimited password guessing.
Limit login attempts per IP address (5 attempts per minute). Automatic IP ban (fail2ban). Use iptables rate limiting: iptables -A INPUT -p tcp --dport 22 -m limit --limit 10/min -j ACCEPT.
Minimum 12 characters (recommend 16). Mix of uppercase, lowercase, numbers, symbols. Block common passwords (rockyou.txt). Use password managers (Bitwarden, 1Password, KeePass).
Best Practice - MFA + Strong Passwords + Account Lockout: Multi-Factor Authentication (MFA) is the most effective defense against brute force attacks (password alone insufficient). Use strong passwords (16+ random characters, password manager). Implement account lockout (5 failed attempts) and rate limiting (fail2ban). Monitor failed login logs (SSH, RDP, web apps). Use password hashing algorithms with high cost (bcrypt cost 12, Argon2id).
Brute force attacks (unauthorized access attempts) are illegal under CFAA (US) and Computer Misuse Act (UK). Penalties apply regardless of success.
Brute force attacks are illegal. Penalties include:
Important: This guide is for educational and defensive purposes only. Unauthorized brute force attacks are illegal.
Comprehensive password wordlists for security testing (rockyou.txt, 10 million passwords).
Official fail2ban configuration: SSH brute force protection, custom jails.
Check if password has been exposed in data breaches.