Popular tools for brute-force attacks [updated for 2025]

The brute-force attack is still one of the most popular password-cracking methods. Nevertheless, a brute-force attack in cybersecurity is not just for password cracking. Password brute-force attacks can also be used to discover hidden pages and content in a web application. This attack involves a “hit and try” approach. Even though it sometimes takes longer than other methods, its success rate is often higher, making it one of the more dangerous cybersecurity threats. 

This article will explain brute-force cracking and popular automated hacking tools used for executing these assaults. 

Editor's note: Want to learn how to hack and use generative AI for cybersecurity? We made a free one-hour course and lab environment: Learn how to hack and use AI.

View Free Course

What is a brute-force attack? 

A brute-force attack is when an attacker uses a set of predefined values to attack a target and analyze the response until he succeeds. As you explore how to brute-force a password, remember that success depends on the size of the set of predefined values. If it is larger, it will take more time, but there is a better probability of success. 

The most common — and simple — example of a brute-force attack is a dictionary attack. With this method, the attacker uses a password dictionary that contains millions of password options. The attacker tries these passwords one by one in successive attempts to satisfy the system’s authentication requirements. The attacker will succeed if the dictionary of options contains the correct password. 

In a traditional brute-force attack, the attacker just tries a combination of letters and numbers to generate a password sequentially. However, this traditional technique will take much longer, especially with long passwords. These attacks can take several minutes to several hours or years, depending on the system used and the length of the password. 

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

To enhance brute-force protection, you should always use long and complex passwords. This makes it hard for attackers to guess the password and their brute-force attacks will take too long. Account lockout is another brute-force attack prevention technique that works well for securing web applications. However, offline software may not be as easy to secure. 

Similarly, to discover hidden pages, the attacker tries to guess the name of the page, sends requests and sees the response. If the page does not exist, it will show a 404 response. When the attacker succeeds, the response will be 200. In this way, an assailant can discover hidden pages on any website. 

Brute force is also used to crack the hash and then guess a password using a given hash. In this method, the hash is generated from random passwords and is then matched with a target hash until the attacker finds the correct one. Therefore, the higher the type of encryption (64-bit, 128-bit or 256-bit encryption) used to encrypt the password, the longer it typically takes to break. 

Reverse brute-force attack 

In a reverse brute-force attack, the attacker tries one password against multiple usernames. Imagine if you know a password but do not have any idea which username it’s associated with. To bypass an authentication system, you can try the same password while guessing different usernames until you find the right combination. 

You can use brute-force attack tools to penetrate any software, website or protocol that does not block requests after a few failed attempts. In the remainder of this post, we will examine some common brute-force password-cracking tools used for a range of different protocols. 

Popular tools for brute-force attacks 

Aircrack-ng 

If you’re like many hackers and penetration testers, you may already be familiar with the Aircrack-ng tool. This is a popular brute-force Wi-Fi password-cracking tool available for free. It comes with WEP/WPA/WPA2-PSK cracker and analysis tools to perform attacks on Wi-Fi 802.11. Aircrack-ng can be used for any NIC which supports raw monitoring mode. 

It basically performs dictionary attacks against a wireless network to guess the password. As you already know, the success of the attack depends on the dictionary of passwords. The more effective the password dictionary is, the better chance you stand of being able to crack the password. 

Aircrack-ng is available for Windows and Linux platforms. It can also run on iOS and Android platforms. You can try it on your platform of choice for brute-force Wi-Fi password cracking as you practice this and other hacking techniques. 

Download Aircrack-ng here. 

John the Ripper 

John the Ripper is another awesome tool that needs little to no introduction. It’s been a top option for many hackers for a long time. This free brute-force software was initially developed for Unix systems. Later, developers released it for various other platforms. Now, it supports fifteen different platforms, including Unix, Windows, DOS, BeOS and OpenVMS. 

You can use this either to identify weak passwords or as part of an authentication bypass attack. 

This tool is very popular and combines various password-cracking features. It can automatically detect the type of hashing used in a password. Therefore, you can also run it against encrypted password storage. 

Basically, it can perform brute-force attacks with all possible passwords by combining text and numbers. However, you can also use it with a dictionary of passwords to perform dictionary attacks. 

Download John the Ripper here. 

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Rainbow Crack 

Rainbow Crack is also a popular brute-forcing tool used for password cracking. It generates rainbow tables for use while performing the attack. In this way, it’s different from other conventional brute-forcing tools. Rainbow tables are pre-computed. This helps reduce the amount of time it takes to perform the attack. 

Fortunately, various organizations have already published pre-computed rainbow tables and made them available online. You can download those rainbow tables and use them in your attacks to save time. 

Rainbow Crack is available for both Windows and Linux and supports all the latest versions of these platforms. 

Download Rainbow Crack and read more about this tool here. 

L0phtCrack 

L0phtCrack is known for its ability to crack Windows passwords. It uses dictionary attacks, brute-force attacks, hybrid attacks and rainbow tables. The most notable features of L0phtcrack are scheduling, hash extraction from 64-bit Windows versions, multiprocessor algorithms and network monitoring and decoding. If you want to crack the password of a Windows system, you can try this tool. 

Download L0phtCrack here. 

Ophcrack 

Ophcrack is another brute-forcing tool that runs on Windows, Linux/Unix and MacOS. It cracks passwords using LM and NTLM hashes and rainbow tables. It’s both free and open-source. 

It can often crack a Windows password in a few minutes. By default, Ophcrack comes with rainbow tables that enable it to crack passwords of less than 14 characters containing only alphanumeric characters. You can download additional rainbow tables as well. 

Ophcrack is also available as LiveCD. 

Download Ophcrack here. 

Hashcat 

Hashcat claims to be the fastest CPU-based password-cracking tool. It is free and comes for Linux, Windows and Mac OS platforms. Hashcat supports various hashing algorithms, including LM Hashes, MD4, MD5, SHA-family, Unix Crypt formats, MySQL and Cisco PIX. It supports various attacks, including brute-force attacks, combinator attacks, dictionary attacks, fingerprint attacks, hybrid attacks, mask attacks, permutation attacks, rule-based attacks, table-lookup attacks and toggle-case attacks. 

Download Hashcat here. 

DaveGrohl 

DaveGrohl is a popular brute-force password cracker for Mac OS X. It supports all available versions of Mac OS X. This tool supports both dictionary attacks and incremental attacks. It also has a distributed mode that lets you use multiple computers to execute an attack on the same password hash. 

This tool is now open-source, and you can download the source code. 

Download DaveGrohl here. 

Ncrack 

Ncrack is also a popular password-cracking tool for cracking network authentications. It supports various protocols, including RDP, SSH, HTTP(S), SMB, POP3(S), VNC, FTP and Telnet. It can perform different attacks, including brute-forcing attacks. It supports various platforms, including Linux, BSD, Windows and Mac OS X. Even though one of Ncrack’s distributors, Nmap.org, says they no longer maintain it, many still use Ncrack as a go-to brute-force attack program. 

Download Ncrack here. 

THC Hydra 

The THC Hydra brute-force tool is known for its ability to crack network authentication passwords via brute-force attacks. Like Ncrack, it’s considered a legacy tool, but attackers and pentesters still use it. It performs dictionary attacks against more than 30 protocols, including Telnet, FTP, HTTP, HTTPS, SMB and more. It is available for various platforms, including Linux, Windows/Cygwin, Solaris 11, FreeBSD 8.1, OpenBSD, OSX and QNX/Blackberry. 

Download THC Hydra here. 

Get your guide to the top-paying certifications

With more than 448,000 U.S. cybersecurity job openings annually, get answers to all your cybersecurity salary questions with our free ebook!

Get Your Copy

Conclusion 

These are some of the most common brute-forcing tools for password cracking. Various other tools are available that programmers have built for use with different kinds of authentication. For example, many of the more popular PDF-cracking and ZIP-cracking tools use the same brute-force methods. Many of them are available for purchase or for free. 

Brute-forcing is one of the most effective password-cracking methods. The success of the attack depends on various factors. However, the most impactful factors are password length and the randomness of the combined characters, letters and special characters. This is why when we talk about strong passwords, we usually suggest that users have long passwords with a combination of lower-case letters, capital letters, numbers and special characters. This does not make brute-forcing impossible, but it does make it difficult. Therefore, it will take a longer time to guess the password via brute force. 

Almost all hash-cracking algorithms use the brute force hit-and-try method. This attack is best when you have offline access to data. In that case, cracking the password is easier and takes less time. 

Brute force password cracking is also very important in computer security. It is used to check for weak passwords in a target system, network or application. 

The best way to prevent brute-force attacks is to limit invalid logins. In this way, attackers only get a few attempts to try to guess each password. This is also why some web-based services start showing Captcha verifications if you try the wrong passwords several times in a row.