logo

Brute Force

Category:

Credential Access

Summary:

How brute-force attacks guess passwords, hashes, and keys through sheer volume — online and offline — and how rate limiting and strong secrets defeat them.

Brute force systematically tries candidate secrets until one works — online against a live login, or offline against a stolen hash — trading precision for sheer volume. It’s the blunt cousin of targeted password spraying (one password, many accounts) and credential stuffing (known-valid pairs); offline cracking is exactly what makes stolen Kerberoasting and AS-REP roasting blobs pay off.

How It Works

  • Online vs. offline — guessing against a live service is slow and noisy; cracking a stolen hash locally is fast and silent.
  • Dictionary, mask, or pure brute — wordlists, pattern-constrained masks, or exhaustive keyspace search, in roughly that order of efficiency.
  • GPU-accelerated cracking with hashcat or John the Ripper turns a stolen hash into a plaintext password in minutes to days.
  • Weak algorithms — unsalted MD5 or RC4 — crack orders of magnitude faster than a properly salted, slow hash.
  • Throttled online guessing deliberately paces requests to slip under simple rate limits.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

logo-cta

How to Detect It

  • Watch for high-volume Event ID 4625 or HTTP 401 responses from a single source hitting one account.
  • Offline cracking leaves no direct signal — watch instead for the hash theft that precedes it (LSASS access, ntds.dit reads).
  • Flag sudden authentication volume spikes against any single credential.

How to Defend Against It

  • Enforce rate limiting, account lockout, and MFA to blunt online guessing.
  • Use slow, salted hashing (bcrypt/argon2) and long random secrets so offline cracking stays computationally infeasible.
  • Add CAPTCHA and anomaly detection on login endpoints once simple throttling is bypassed.

Validating Your Defenses

Testing both paths — a throttled online guess run and an offline crack of a sample hash — shows which layer actually holds. Record time-to-crack and the point rate limiting kicked in so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.