Brute force, or password guessing, attacks are very common against websites and web servers. They are one of the most common vectors used to compromise websites. The process is very simple and the attackers basically try multiple combinations of usernames and passwords until they find one that works.
Once they get in, they can compromise the website with malware, spam , phishing or anything else they want.
Brute Force Targets
Any website with a login page is a target, but the following are the most commonly attacked pages:
- WordPress wp-admin/wp-login.php
- Joomla /administrator/
- Drupal /admin/
- Magento /index.php/admin/
- vBulletin /admincp/
- Generic /login pages
Username and Passwords
Most attacks rely on a dictionary of the most commonly used usernames and passwords and tries all of them. They also permutate
entries related to the web site domain and content to increase their success.
We have a few blog posts with more information about this, but these are the top used passwords:
admin 123456 password 12345678 666666 111111 1234567 qwerty siteadmin administrator root 123123 123321 1234567890 letmein123 test123 demo123 pass123 123qwe qwe123 654321 loveyou adminadmin123
And these are just a few entries. Most attacks try thousands of password combinations.
Brute Force Protection
Humans are very bad at choosing passwords and that’s what these attacks try to exploit. You can minimize the risks by rate limiting login attempts, choosing good passwords and restricting access to the admin pages to only white listed IP addresses.
Any client using our WAF is automatically protected. We restrict access to the login pages to only authorized IP addresses and we also have a brute force detection included that blocks an IP address after too many failed login attempts.