Brute force

A brute force attack is a method of breaking authentication by systematically trying candidate passwords, keys or PINs until one works. It exploits no software vulnerability at all — its only ingredients are computing power and time, which makes it both primitive and remarkably persistent: any login endpoint reachable from the internet will be probed, usually within hours of going online.

How brute force attacks work

Several variants dominate real-world traffic:

• exhaustive brute force — trying every character combination; only feasible against short passwords,
• dictionary attacks — wordlists of common passwords and mutations ("Summer2024!") tried first, drastically cutting search time,
• credential stuffing — login/password pairs leaked from other services replayed everywhere, exploiting password reuse,
• password spraying — one popular password tried across thousands of accounts, deliberately staying under per-account lockout thresholds,
• offline cracking — stolen password hashes attacked on GPU rigs at billions of guesses per second, with no rate limits to slow anyone down.

Favorite targets include WordPress and hosting-panel logins, SSH and FTP services, mailbox accounts and APIs. Modern campaigns run through botnets spanning thousands of IP addresses, so blocking a single source achieves little.

Practical defense

Effective protection stacks several layers. On the account side: long, unique passwords stored in a password manager, and two-factor authentication, which turns a guessed password into a dead end. On the server side: rate limiting and automatic IP bans driven by log analysis (Fail2ban is the classic tool), CAPTCHA after repeated failures, SSH restricted to key-based authentication, root login disabled, and — where possible — admin panels hidden behind a VPN or IP allowlist. VPS administrators often move SSH off port 22 as well; it stops no determined attacker but filters out mass scanners and keeps logs readable.

Finally, watch your authentication logs: a sudden spike in failed logins is usually the first sign of an active campaign and the right moment to tighten firewall rules.