Brute force attacks work by targeting a system that requires authentication, such as a login page or an encrypted file. Attackers use automated tools to generate and test multiple combinations of credentials at high speed. The attack continues until the correct combination is found, allowing the attacker unauthorized access.