I was wondering how bruteforce methods work from a code level. How does the code get access to a login page for example and insert information into the necessary fields? And is the code able to duplicate the system so that 3 attempts or waiting between guesses is no longer a problem?

  • I assume the code uses something simple like the PHP "POST" function. If it is something you have access to and can replicate, say a computers SAM and CONFIG files, it is possible to split the brute-forcing capability between multiple computers to speed up the process.
    – cutrightjm
    Jul 30, 2013 at 20:11

1 Answer 1


There are online attacks and offline attacks.

Online attacks are when the attacker tries each password by sending it to the attacked system. The attacked system might be using, for instance, an HTML login page; in that case, the attacker would first manually obtain a copy of the login page (like any other user, with a Web browser), then look at the HTML, and infer the format of data that is sent to the server. Most login pages are simply HTML Forms; when a user enters the login and password and clicks on the "log me in" button, the browser sends an HTTP request which encodes the data entered by the user. The attacker then just has to build, with some custom code, synthetic HTTP requests which use the same format.

As for how often the attacker will try... well, it depends. On one hand, the attacker has a lot of passwords to try, so he will send many requests, include a lot in parallel because the server itself can handle several incoming requests simultaneously, and will process more requests per second when used in parallel than if the client (the attacker) waited for an answer before sending his next request. Parallelism absorbs latency, in a way.

On the other hand, some sysadmins include detection systems for "suspicious activity" and receiving 100 login attempts for a given user login per second surely looks unnatural. Therefore, some attackers will try the low-profile thing, trying only one password at a time, and waiting several minutes between any two attempts. The attacker tries to stay under the radar. This can still be an efficient strategy for the attacker, if he has lots of user logins to try on lots of distinct servers.

Offline attacks are very different. In an offline attack, the attacker was lucky enough to obtain enough information to "test passwords at home". For instance, through some SQL injection attack, the attacker grabbed a copy of the hashed passwords for a thousand users of a given site. The attacker can then proceed to "try" passwords by hashing each potential password and seeing if the hashed version matches the database table that he previously purloined. All of this occurs on the attacker's PC, with no network at all, and nobody else is made aware of the cracking effort.

Offline attacks are a bigger worry than online attacks because in an offline attack, attackers are limited only by their available computing power; there is no honest server who can arbitrarily limit the rate at which passwords can be tried. With simple hashing functions, attackers can try billions of passwords per second, with off-the-shelf consumer hardware (a PC with a big, gaming-class GPU). There are mitigation measures but they are not perfect (they are relatively expensive trade-offs). It is much better to avoid offline attacks in the first place (i.e. check your SQL statements, dammit !).

  • Also don't forget about CSRF protection in online attacks. It can stop attackers right at the beginning.
    – byf-ferdy
    Jul 31, 2013 at 8:12
  • @byf-ferdy CSRF protection is NOTHING like this, if you can submit a POST you can do a GET+POST, it just increases the attacking time by a factor of 2 (It is like saying 127 bit is insecure let's use 128 bits.) (at most 2 considering GET is as fast as POST) CSRF serves for if I can trick users browser visiting the website x to submit a form to website y.
    – EralpB
    Feb 18, 2018 at 17:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .