What is brute force attack?

Reply 1)

Brute force attack is nothing but trying each and every combination of the password with the authority.
Let’s say we know that password 3 character long – taking this as just a example.

These 3 characters will be from following sets

A-Z
a-z
1-9

So attacker will start from A and check that till 9 for first set.
Then he will start with 2 characters – AA till he reaches till end 99.
Then he will start with 3 characters – AAA till 999
Here I am not considering the symbol set (~!@#$%^&*()_+|{}:”<>?,./;’[]. )
That is how the brute force method works.

There is one more common method which is used more.
That is Dictionary attack.
In dictionary attack, there is a file which contains all words – which generally people may use as passwords
Using such files, number of attempts gets reduced.

Let’s talk about something about Active directory, what is the functionality provided by AD to avoid such attacks.

In AD we see that if we type a wrong password for about 3 or 4 times then it gets locked for some period. (we can set count in password policy in Default Domain policy)

This functionality reduces the attack surface.

By locking your account, attacker can’t attempt any more passwords for 20 or 30 min as your account gets locked out. ( again account lockout period can be set in password policy)
This increases time for attacker. Also gives time and notifications to admins that something is going on for specific account.