A brute-force attack consists of an attacker submitting many passwords or usernames with the hope of eventually guessing correctly. The attacker systematically checks all possible passwords and usernames until the correct one is found. So basically it is a hacking technique used to find out the user's credentials by trying various possible combinations and permutations of passwords and usernames of a victim and trying to see if you can get any of those right.

Brute force is a hacking technique where you are getting the credentials were not basically exploiting any vulnerability of the web application because you have a large list of usernames and a large list of passwords and in some cases, if you know what the username is then the user in a single but the password is a large list of possible passwords so you have to try each of these combinations and see whether you get it right or wrong so it's basically a trial and error method and for brute force attacks you need a username list and a password list and some of the tools like John the ripper, Aircrack-ng, Hashcat, hydra and Medusa. Aircrack-ng can be used on Windows, Linux, iOS, and Android and John the Ripper run on 15 different platforms including Unix, Windows whereas Hashcat works on Windows, Linux, and Mac OS. L0phtCrack is a tool used for cracking Windows passwords.

** let's see how the brute force attack works.**

First, there is a brute force tool to which you feed username and password may be one username and list of password or a list of username and list of password, So these brute force tool will send the combination of this username and password to the web application or the application in general where username and password checked it is authenticated and depending on the response of the application the tool decides whether the credentials are right and wrong. If the login was successful then the username and password are considered to be right if the login is failed then it is considered that combination of username and password to be wrong.

Lastly, let’s see ways to prevent brute force attack

• Use strong passwords (combination of alphabets, number, and special characters): By increasing the password length brute force attack can be prevented. If you create a password with a greater length it will take more time also make it more difficult for hackers to hack the password also you increase the complexity it makes more difficult task for hackers to hack the password. Suppose if a user is using only a number then the password generator can generate your password very quickly and if the user using a combination of letters and numbers the complexity increases also by using the letter, numbers and special characters the complexity increases even more.
• Limiting login attempts: As a web developer you can set a limit on login attempts and if the user or hacker crosses those limits then freeze that account for a specific time so that it takes more time for the hacker to hack your password.
• Use OTP: Lot of application sectors using OTP because maybe a password and username are easy to guess but OTP is acting as another parameter to verifies your account. This OTP is valid for a small amount of time.
• Use of CAPTCHA’s: It makes it almost impossible for a brute force attacker to hack your account. These are some techniques by using which we can prevent the system from the brute force attack.

There is not only a single method for prevention. We should use possible ways to prevent brute force attack because Brute force attack will be different-different nature according to attack condition