Home/ Glossary/ Brute Force Attack

Brute Force Attack (Brute Force Attack)

Security Glossary - Web Security

Definition: A brute force attack is a trial-and-error method where an attacker systematically tries every possible password, key, or credential combination until finding the correct one. Credential stuffing - using leaked username/password pairs from data breaches - is a related technique that is often more efficient than pure brute force.

Why You Should Care About Brute Force Attack

Brute force attacks target any authentication mechanism: login forms, API keys, session tokens, and encrypted data. With automated tools, attackers can try thousands of passwords per second against a login endpoint that lacks rate limiting.

Credential stuffing is effective when users reuse passwords across services. Credentials exposed by one service can then be tested against unrelated accounts, so defenses must not assume that a syntactically valid password is known only to its owner.

Defenses include rate limiting (restricting login attempts per IP and per account), account lockout policies, CAPTCHA after failed attempts, multi-factor authentication (which makes stolen passwords insufficient), and monitoring for unusual login patterns (multiple accounts from one IP, logins from unusual locations).

How to Test for Brute Force Attack

Test rate limiting only on systems you own or are authorized to assess, with a bounded test plan that will not lock out users or overload the service. DomainOptic's passive audit does not probe authentication endpoints or CAPTCHA behavior.

Run a Security Audit

Questions and Answers

How do I protect against brute force attacks?
Use layered controls such as rate limits by account and network signal, progressive delays, compromised-password screening, multi-factor authentication, anomaly detection, and user notification. Tune thresholds from observed traffic rather than copying one universal number.
Is account lockout a good defense?
Account lockout prevents brute force against a specific account but can be used for denial-of-service (locking out legitimate users). Use progressive delays (1 second, 2 seconds, 4 seconds, etc.) rather than permanent lockout. Combine with CAPTCHA for better balance.

Learn More

Rate Limiting Denial of Service Attack Web Application Firewall Cookie Security Flags OWASP Top 10
Disclaimer: DomainOptic provides automated informational scans only. Results do not constitute professional security advice, compliance certification, or a guarantee of security. Always verify findings independently.