I keep seeing tables of how easy it is to brute force a password depending on length and complexity, but how does the brute force attack get past the account lockout feature?

Question

Every system I’ve ever maintained has an account lockout after a few attempts.

In: 2

Answer 1

pure brute force attacks arent really a thing anymore,mostly because of time and said systems.

instead you have avariatino of it by acquiring the database of the target you can attempts to brute force the passwords listed there. this bypasses lockout features because you are not interacting with the login systme directly anymore.

instead of trying every single character combination, you limit your search to every single known word aka: a dictionary attack.