Can anyone give me an overview (no links) on how brute force password attacks work against web based forms / login pages in .net apps. Do the malicious apps work directly on the web form or some other way, i.e. downloading the page from the browser and then attacking that way. I understand how they work against single files such as documents, but not sure how they penetrate online forms such as login forms to an application