They even try a dictionary attack -- another super low-tech method that's easy to defend against, but too many systems and services don't guard against it.
A dictionary attack will scan through a number of pre-defined wordlists while an incremental attack will count through a character set until it finds the password.