CyberGlossary

Attacks & Threats

Brute Force Attack

Also known as: Exhaustive search

Definition

An attack that systematically tries every possible value — typically passwords, PINs, or keys — until the correct one is found.

Brute force attacks exhaust a candidate space by trial. Online variants hammer authentication endpoints with guesses, while offline variants run against stolen hashes using GPUs, FPGAs, or rented cloud compute. The feasibility depends on the size of the keyspace, the work factor of any password-hashing algorithm (Argon2, bcrypt, scrypt, PBKDF2), and operational controls like rate limiting and account lockout. Defences include strong, unique credentials, salted memory-hard hashing, MFA, exponential back-off, IP/device throttling, web-application firewalls, and monitoring for anomalous authentication patterns. Cryptographic keys should use sufficiently large sizes (e.g. 256-bit symmetric, 3072-bit RSA or equivalent ECC).

Examples

  • Hashcat cracking leaked NTLM hashes at billions of guesses per second.
  • An attacker hammering an exposed RDP server with common admin passwords.

Related terms