Ethical Hacking and Penetration Testing Guide

Overview of Brute Force Attacks
Brute force attack is a process of guessing a password through various techniques. Commonly, 
brute force attacks are divided into three categories:
Traditional Brute Force
In a traditional brute force attack, you will try all the possible combinations to guess the correct 
password. This process is very usually time consuming; if the password is long, it will take years 
to brute-force. But if the password is short, it can give quick results. Though there are alternative 
methods to reduce the time taken to brute-force a password, but still under a normal penetration 
test this type of attack should be avoided.
Dictionary Attacks
In a dictionary-based brute force attack, we use a custom wordlist, which contains a list of all pos-
sible username and password combinations. It is much faster than traditional brute force attacks 

---

Remote Exploitation
◾ 
167
and is the recommended approach for penetration tests. The only downside is that if the password 
is not available in the list, the attack won’t be successful. We have already discussed some tools 
that can be used to gather password lists from victim’s website in the “Information Gathering 
Techniques” chapter (Chapter 3). So what we learned in that chapter will start to make sense now.
Hybrid Attacks
Hybrid brute force attacks are a combination of both traditional brute force attack and dictionary-
based attack. The idea behind a hybrid attack is that it will apply a brute force attack on the dic-
tionary list. An example of this type of attack is the following:
A university has set up a password policy where the password is their “first name” followed by 
their date of birth. For example, my first name is “Rafay” and my date of birth is February 5, 1993; 
therefore, my password would be “Rafay521993.” In this case, neither traditional brute force nor 
dictionary attack would be effective, but the hybrid attack would be.