How does brute force work?

Question

Information Security

When you try to find out how brute force works, you only see a general explanation of the principle. However, speaking in the context of the web, how can an attacker substitute generated passwords? If an ordinary person logs into his account, he enters the required data into the input, but if the hacking program entered the data into the input automatically, or changed the value of the cookie that is responsible for authentication, then this would be quite slow (every time accessing server waiting for a response ..) and it would be unrealistic to quickly go through a large number of options. So the question is: how does it work?