A pure brute-force attack involves systematically generating and testing every possible combination of characters (letters, numbers, symbols) within a defined character set and length. For example, if a password is 8 characters long and uses only lowercase letters, there are 26^8 possible combinations. This makes it highly impractical against well-protected systems with account lockout policies or rate limiting. Variations like dictionary attacks are more efficient.

Dictionary attacks are a subset of brute-force attacks that are significantly more efficient. Instead of trying every single character combination, they use a pre-compiled list of common words, phrases, names, and variations (e.g., 'password123', 'qwerty', 'admin'). Attackers often enhance these dictionaries with common substitutions (e.g., 'a' to '@', 's' to '$') and append numbers or special characters. The effectiveness depends heavily on the quality and comprehensiveness of the dictionary file.

Hybrid attacks are a powerful combination of dictionary and brute-force techniques. They start with words from a dictionary and then apply rules to modify them. These rules can include appending numbers (e.g., 'password123'), prepending numbers, substituting characters (e.g., 'P@$$wOrd'), or changing case. This approach significantly increases the chances of finding a password that might not be in a simple dictionary but is still based on common patterns.

Rainbow tables are a time-memory trade-off technique used to crack password hashes. Instead of generating hashes on the fly for each guess (like brute-force), they pre-compute a large database of hash values for a vast number of possible passwords. When an attacker obtains a password hash, they can look it up in the rainbow table to quickly find the original password. They are particularly effective against older hashing algorithms like MD5 and SHA-1, but require significant storage space and are less effective against modern, salted hashes.