What is a brute force attack?

A brute force attack is a type of cyberattack where the attacker uses an automated system to try different combinations of username and password until they find the correct combination. This can be done by using a dictionary of common words or by using a list of common passwords. The attacker will keep trying different combinations until they find the right one.

How to prevent brute force attacks

There are several steps you can take to prevent brute force attacks:

Use strong passwords: A strong password is at least 8 characters long and contains a mix of uppercase and lowercase letters, numbers, and special characters.

Never use the username “admin”. When performing a new WordPress installation, choose a different user name for that, and if it is in use remove it.

Use two‑factor authentication: Two‑factor authentication adds an extra layer of security to your account by requiring you to enter a code from your phone in addition to your password.

Limit login attempts: Limiting the number of login attempts makes it more difficult for attackers to guess your password.

Monitor for suspicious activity: Monitoring your account for suspicious activity can help you detect an attack early and take action to protect your account. If you see someone trying to log in from multiple locations or devices, or if you see someone trying to log in after normal business hours, those could be signs that someone is trying to brute force their way into your system.

Educate your peers and employees about best practices for securing their accounts. They should know not to use weak passwords or reuse passwords across different accounts. They should also know how to spot suspicious activity and who to contact if they see something suspicious.

By following these steps, you can help prevent your organization from falling victim to a reverse brute force attack.

The Different Types of Brute Force Attacks (And How to Protect Against Them)

There are different types of brute force attacks including dictionary attacks, rainbow table attacks, hybrid attacks, reverse brute force attacks, and credential stuffing attacks.

Dictionary Attacks: A dictionary attack is a type of brute force attack that uses a list of words (usually taken from a dictionary) as the basis for guessing the username and password. These attacks are relatively simple to execute and can be difficult to defend against because they do not require a lot of technical expertise.

Rainbow Table Attacks: A rainbow table attack is a type of brute force attack that uses a pre‑generated list of words and passwords (known as a “rainbow table”) as the basis for guessing the username and password. These attacks are very sophisticated and can be challenging to defend against because they use a large number of possible combinations.

Hybrid Attacks: A hybrid attack is a type of brute force attack that combines elements of both dictionary attacks and rainbow table attacks. These attacks are more sophisticated than dictionary attacks.

Reverse Brute Force Attacks: Instead of guessing the correct credentials, the attacker tries to brute force their way into every account on the system.

Reverse Brute Force Attacks are especially dangerous because they can be difficult to detect. If an attacker gains access to just one account, they can then use that account to move laterally and gain access to other accounts on the system. This type of attack is difficult to detect because it does not generate a lot of traffic. The attacker only needs to make a few requests for each account they are trying to compromise. As a result, this type of attack can go undetected for a long period of time.

Another reason why a reverse brute force attack is difficult to detect is that it does not leave any traces on the system that was compromised. Once the attacker gains access to an account, they can delete any logs that show that they were ever there. This makes it difficult for security teams to determine what happened and who was responsible.

Credential Stuffing: This is a type of cyberattack in which hackers use stolen usernames and passwords to gain access to accounts. This type of attack is possible because many people use the same password for multiple accounts. Once the hackers have access to one account, they can try the same username and password combination on other websites until they find one that works.

Credential stuffing is a serious threat because it can lead to identity theft, financial loss, and damage to your reputation. If you are a victim of credential stuffing, you should change your passwords and monitor your accounts for unauthorized activity. You should also report the incident to the police and file a complaint with the Federal Trade Commission.

Hackers will use lists of stolen usernames and passwords to try to gain access to accounts. These lists are often obtained through data breaches at major companies.

Once the hackers have access to one account, they can try the same username and password combination on other websites until they find one that works. This type of attack is especially dangerous because it can be difficult to detect. Hackers can use automated tools to make thousands of attempts to login to an account within a short period of time.

Brute Force Attack Tools

Hydra is one of the most popular brute‑force attack tools available. It’s fast, flexible, and supports a wide range of protocols. One of the main advantages of Hydra is that it can perform parallel attacks, making it much more effective than other brute‑force attack tools.

Medusa is another popular brute force attack tool that supports a wide range of protocols. One of the main advantages of Medusa is that it’s very configurable, allowing you to tailor the attacks to your specific needs.

Ncrack is a newer brute‑force attack tool that has gained popularity due to its high performance and low CPU utilization. Ncrack also has the ability to perform parallel attacks, making it one of the most effective brute‑force attack tools available.

RainbowCrack is a brute‑force attack tool that uses time‑memory tradeoff to crack hashes in less time than traditional brute‑force attack tools. RainbowCrack is very effective against hashes that are weak or have been poorly chosen.

WPScan Brute Force Protection

One of the many features of the WPScan security scanner is password brute forcing. Our WPScan CLI (Command Line Interface) tool can be used to iterate over a password list to try to guess a user’s password.

To launch a password brute force attack with WPScan CLI against a WordPress website, the command looks like this:

wpscan –url http://test.local/ –passwords passwords.txt

We pass WPScan the site URL with the –url parameter, and the password list, in this case named passwords.txt, with the –passwords parameter. In this screen grab you can see that WPScan successfully guessed the admin user’s password.

In our case, WPScan automatically found three valid WordPress users (admin, editor, and author) and then started to cycle through our password list attempting to log in as each of them.

WPScan supports password brute forcing via the traditional wp‑login.php page and via the XMLRPC interface if it is enabled.