Password Guessing Alternative: Password Spraying

Password Guessing Alternative: Password Spraying

What is password spraying?

Testing a small number of candidate passwords across many user accounts.

Why do attackers use password spraying instead of traditional password guessing?

To reduce the chance of triggering account lockouts.

How does password spraying differ from traditional password guessing?

Spraying uses a few passwords across many accounts; traditional guessing uses many passwords against fewer accounts.

How many candidate passwords does the course example use in one spraying round?

Four.

How many accounts might a spraying attack target?

A thousand or more accounts, according to the course example.

In the course example, what happens after trying four passwords against Account A?

The same four passwords are tried against Account B, and so on.

What might an attacker wait for before beginning another round of spraying?

The bad-login counter expiration timer to reset.

Why does waiting for the failed-login counter to reset matter?

It may allow another small round of guesses without reaching the lockout threshold.

When might attackers move from one system to another during password spraying?

When there is no centralized authentication mechanism, while waiting for failure counters to reset.

What type of asset does an attacker need to conduct an online password spraying attack?

An accessible service that requires authentication.

Which remote-access protocol is given as a password-spraying target example?

SSH.

Which Windows file-sharing protocol is mentioned as a possible password-spraying target?

SMB.

Which Windows remote-login protocol is mentioned as a possible password-spraying target?

RDP.

Does password spraying require a long list of possible passwords?

No. It deliberately uses a small number of passwords per round.

What is the main distribution pattern of a password spray attack?

A small password set repeated across a large set of usernames and possibly systems.

Which MITRE ATT&CK technique does the book associate with password spraying?

T1110, Brute Force.

What risk does password spraying try to minimize?

Account lockout caused by repeated failed logins to the same account.

What can defenders look for when investigating password spraying?

The same few password guesses attempted across many user accounts; the book describes this distribution pattern.