Brute Force Attack

A brute force attack relies on repeated guesses rather than a single clever exploit. Against a login page, an attacker may try large numbers of possible passwords for one account; related approaches include dictionary attacks, password spraying, and credential stuffing, though their input patterns differ. Automated guessing may also target predictable paths or other exposed values.

A local business running a customer portal might notice many unsuccessful sign-in attempts. High failure counts can be a useful alert, but they do not by themselves identify a successful compromise or the source of the attempts. The defensive response may include multifactor authentication, carefully designed rate limiting, monitoring, secure password storage, and avoiding account-enumeration clues. Account lockouts need care because an attacker could exploit them to deny legitimate users access.

OWASP distinguishes brute forcing one account with multiple password candidates from credential stuffing with previously stolen username/password pairs and spraying a common password across many accounts. A firewall rule alone is not a full solution, and a CAPTCHA is only one possible additional control. For a business website, the practical aim is to reduce opportunities for automated login abuse while keeping recovery and legitimate access workable. Incident evidence should be reviewed rather than publicly labeling unfamiliar visitors as attackers.