Lesson 4 of 6

Brute Force Techniques

Brute force attacks systematically try every possible combination of characters until the correct password is found. You will learn when brute force is practical versus impractical, how to use mask attacks in Hashcat to target specific password patterns, and how online brute force tools like Hydra work against login forms. Understanding brute force helps you design password policies that make it computationally infeasible.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is asking you to build a clear mental model of the concept — not just memorize a definition, but genuinely understand what it means, why it exists, and how it connects to everything else you are learning. When you can explain "brute force attack methodology" in your own words to someone who has never heard of it, you have truly learned it.

Why this matters

Understanding how attacks actually work is what makes you effective at defending against them. You cannot build strong defenses if you do not understand what attackers are trying to do and how they do it. This knowledge is the core of offensive and defensive security alike.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Brute Force Techniques · Objective 1 of 4

VIDEO

Loading video…

Estimate the password space

Calculate the total number of possible passwords for a given character set and length using the formula: charset_size ^ length. For an 8-character password using only lowercase letters (26 characters), the space is 26^8 = 208 billion combinations. Adding uppercase doubles the charset to 52, giving 52^8 = 53 trillion combinations. Adding digits and symbols (95 printable ASCII characters) gives 95^8 = 6.6 quadrillion combinations. Understanding password space helps you decide whether brute force is feasible — at 10 billion attempts per second, a 95-character 8-character password would take about 7.6 days, while a 12-character password would take millions of years.

Run a mask attack for a known pattern

Run 'hashcat -m 0 -a 3 hash.txt ?u?l?l?l?l?d?d?d?s' to attempt a mask attack matching a specific pattern: one uppercase letter, four lowercase letters, three digits, and one symbol. Hashcat mask characters are: ?l (lowercase a-z), ?u (uppercase A-Z), ?d (digit 0-9), ?s (special characters), ?a (all printable ASCII). Mask attacks are extremely efficient when you know something about the password structure — for example, many corporate password policies require exactly this kind of pattern, and users often comply with the minimum requirements rather than creating truly random passwords.

Use increment mode

Run 'hashcat -m 0 -a 3 hash.txt --increment --increment-min=6 --increment-max=10 ?a?a?a?a?a?a?a?a?a?a' to try all lengths from 6 to 10 characters using all printable ASCII characters. Increment mode starts at the minimum length and works up, so shorter passwords are cracked first. This is useful when you do not know the password length — start with increment mode to find short passwords quickly, then run targeted masks for specific patterns if increment mode does not succeed. Be aware that increment mode with a large charset and long maximum length can run for days or weeks on complex hashes like bcrypt.

Monitor progress

While Hashcat is running, press 's' to display the current status without interrupting the session — it shows the hash mode, attack type, speed, progress percentage, estimated time remaining, and number of recovered hashes. Press 'p' to pause and 'r' to resume if you need to free up GPU resources temporarily. If you need to stop a session and resume it later, press 'q' to quit and then restart with the '--restore' flag to continue from where you left off. Monitor GPU temperature with 'nvidia-smi' in a separate terminal — sustained temperatures above 85°C can damage your GPU and should be addressed by reducing the workload or improving cooling.

Previous: Dictionary Attacks with Hashcat Next Lesson