A brute-force attack tries many possible combinations until the right one is found. In practice, it most often targets passwords. NIST describes it as attempting multiple combinations to access a protected device or to find a cryptographic match.

How it works

MITRE ATT&CK (T1110) describes several variants:

• Password guessing: trying many passwords against one account, often from a dictionary of common choices.
• Offline cracking: testing guesses against stolen password hashes, with no login attempts at all.
• Password spraying: trying a few common passwords against many accounts.
• Credential stuffing: reusing username and password pairs from earlier breaches.

Automated tools can make very large numbers of attempts, which is why short or common passwords fall fast.

Why it matters for defenders

Online guessing can be slowed with account lockout, rate limits and MFA. Offline cracking cannot be slowed that way, so strong password hashing and long, unique passwords matter. When a password database leaks, attackers can crack it at leisure. Knowing early that company account data has appeared in a breach gives teams time to reset passwords before cracked credentials are used.

Sources: MITRE ATT&CK T1110: Brute Force, NIST CSRC Glossary: brute force password attack