9:49 · Oct 2026

Password Spraying

Password spraying is the second phase of an Active Directory attack. We are past unauthenticated recon now and into password attacks, building directly on what we gathered earlier. You need two things before you can spray: a list of usernames, and a single password you found somewhere but cannot yet tie to an account.

Timestamps

  • 00:00 What password spraying is and what you need
  • 00:17 Where it fits: the password attacks phase
  • 00:40 The Cicada box and the NetExec Wiki
  • 01:19 One password, many users, and why it avoids lockout
  • 02:26 Checking the password policy as guest
  • 03:06 Rebuilding the user list
  • 03:30 The spray: NetExec SMB with continue-on-success
  • 04:40 A hit on Michael Wrightson
  • 05:05 Spraying against Kerberos and the error skew tell
  • 06:05 Re-running enumeration with credentials
  • 07:52 Reading the password policy as a valid user
  • 08:44 The WinRM check and what comes next

Goes deeper in the book

Professional Penetration Testing

Chapter 6 - Reconnaissance