Password Spraying

• Password policy & cadence

  • Read lockout threshold/reset and complexity; ≤1 try per account per window; low concurrency.

• Password lists

  • Example: CompanyName2025!
  • Statistically likely password lists

• Spray (Kerberos preferred)

  • One password across many users; wait ≥ reset window.
  • kerbrute passwordspray -d <domain> --dc <dc-ip> <userlist> <password>

• Validate successes (single check)

  • nxc smb <target> -d <domain> -u <user> -p <password>
  • smbclient -L //<host> -U <DOMAIN>/<user>%<password>

• Notes

  • Remove successful users from future sprays.
  • Avoid SMB/LDAP sprays against DCs; log results.