What are the different types of brute force attacks?

Brute force attacks come in several forms, each with unique characteristics and methods. Understanding these differences is crucial for effective prevention. Most attacks are credential-based attacks carried out by threat actors seeking financial gain or data theft.

Online vs. offline attacks

Online brute force attacks target a running website or mobile app. They’re convenient because you can send bots to any online website, but they can be quite slow because the hacker needs to wait for the targeted server to respond. Companies also tend to rate-limit their vulnerable endpoints, further slowing such attacks.

Offline brute force attacks are only possible when a hacker has gained access to a database file with encrypted information. Once a hacker gets their hands on such a file, they can try different keys to decrypt the information on their computer instead of on a distant server, which makes offline attacks significantly faster.

Dictionary attacks

Dictionary attacks use a predefined list of common passwords and words to guess the correct password. The hacker’s bots rotate through combinations of dictionary words to guess usernames and passwords. Dictionary attacks work because people frequently use dictionary words in their passwords.

Hybrid attacks

A hybrid brute force attack combines a dictionary attack with a basic brute force attack. When dictionary attempts fail, the attacker switches to systematic character combinations, trying every possible arrangement of letters, numbers, and symbols. This method is particularly effective because it targets both common password patterns and complex combinations.

Password spraying

Password spraying applies a single common password across multiple accounts. Instead of trying many passwords against one account, attackers flip the script—testing commonly used passwords like “Password123!” or “Summer2024” against thousands of usernames. This method stays under the radar by avoiding account lockout policies that trigger after too many failed attempts on a single account.

One password tested against many accounts

Reverse brute force attacks

A reverse brute force attack starts from a publicly known or leaked password. With that password, the hacker will use automation to search for a matching username, account number, or key. This method leverages passwords leaked from previous data breaches that can be found online.

Credential stuffing

Many users use the same credentials for multiple accounts.Credential stuffing exploits this by reusing stolen username-password combinations to gain unauthorized access to other accounts. Hackers use automated tools to try these stolen credentials across various websites until they find matches.

Rainbow table attacks

Rainbow tables are precomputed tables containing hash values used to crack passwords. Rainbow table attacks can crack hashes of passwords that have been hashed using various algorithms, including MD5, SHA-1, and NTLM. Attackers can quickly look up the corresponding plaintext for a given hash without the computationally intensive process of hashing all possible plaintexts.