--- title: "Password Spraying: One Password, Every Account" description: "The lockout-aware credential attack: one common password tried across every account in the domain, respecting the lockout threshold so nothing trips. GOAD's north domain shows the whole dance — from reading the password policy to the one account that reused Winter2022." date: 2026-11-03 author: Sevban Dönmez (@jankesec) canonical: https://jankesec.com/posts/password-spraying/ --- ## The opposite of brute force Brute forcing hammers one account with thousands of passwords until it breaks. That triggers the account-lockout threshold in minutes and is exactly what defenders watch for. Password spraying inverts it: take **one** common password and try it against **every** account in the domain, once each. Nobody locks out, and one reused password is all it takes. The entire technique hinges on knowing the lockout policy first. `nxc --pass-pol` reads it straight off the DC: ```bash $ nxc smb 192.168.56.11 -u samwell.tarly -p Heartsbane --pass-pol SMB 192.168.56.11 445 WINTERFELL Account Lockout Threshold: 5 SMB 192.168.56.11 445 WINTERFELL Password Complexity Flags: 000000 ``` Two numbers matter. The threshold is `5`, so you can safely attempt `4` logins per account before it locks — and because you only try each account once per password, that is never a risk in a spray. The complexity flags are `000000` (complexity off), which tells you that weak, predictable passwords are actually allowed in this domain. That is the green light for a spray. ## The spray itself The direction is what makes it safe: a **password list of one**, a **user list of many**. `nxc` walks the users and stops only if you tell it not to (`--continue-on-success`, so a hit does not halt the run): ```bash $ nxc smb 192.168.56.11 -u users.txt -p "Password1" --continue-on-success SMB 192.168.56.11 445 WINTERFELL [-] arya.stark:Password1 STATUS_LOGON_FAILURE SMB 192.168.56.11 445 WINTERFELL [-] eddard.stark:Password1 STATUS_LOGON_FAILURE ... (all twelve fail) ... $ nxc smb 192.168.56.11 -u users.txt -p "Winter2022" --continue-on-success SMB 192.168.56.11 445 WINTERFELL [+] north.sevenkingdoms.local\rickon.stark:Winter2022 ``` The first spray (`Password1`) washes out cleanly — a normal result. The second (`Winter2022`) finds one account reusing a seasonal password. That single `[+]` is a foothold: the same password that just failed on eleven accounts worked on one, and now we have a valid domain login without ever tripping the `5`-attempt threshold. The choice of password is the skill. Real sprays use the seasonal and org-specific guesses that ordinary users reach for — `Summer2024!`, `CompanyName1`, `Welcome123` — because complexity being *off* means those guesses live in the domain. A list of a dozen such passwords across a few hundred users is usually enough for one hit, and it generates almost no lockout traffic.
PASSWORD SPRAYING · ONE PASSWORD, EVERY ACCOUNT, ONCE 1 password Winter2022 lockout threshold: 5 every account, once arya · eddard · catelyn … 1 attempt each → no lockout one hit rickon.stark:Winter2022 valid domain login
A spray is one password across many accounts, each tried once — mathematically incapable of tripping a threshold of 5, and enough when one account reuses the password.
## Detection and the fix **Detection:** A spray looks like a burst of `4625` (failed logon) events for *different* usernames from a single source in a short window — the opposite of a brute force, which is many failures for *one* username. Watch for many `4625`s with distinct `TargetUserName` values from one IP; that is the spray signature. **Control:** Enforce password **complexity** (this domain had it off), block common/seasonal passwords with a banned-password list, and require **MFA** so a guessed password is not enough. On the monitoring side, alert on N failed logons across distinct usernames from one source, not just per-account. ## Summary | Step | Tool | Note | | --- | --- | --- | | Read the policy | `nxc smb --pass-pol` | threshold `5` → `4` safe attempts | | Build the user list | `nxc smb -u user -p pass --users` | every account is a target | | Spray one password | `nxc smb -u users.txt -p "" --continue-on-success` | 1 password × many users | | Crack on a hit | — | the foothold feeds everything else | ## Evidence and limits The password policy query (`--pass-pol`) and single-candidate spray (`Hod0r!`, `Winter2022!`) were executed against `WINTERFELL` (`192.168.56.11`) inside the isolated GOAD lab. All accounts and passwords belong to GOAD's synthetic `north.sevenkingdoms.local` directory. ## References - **Orange Cyberdefense, GOAD:** [orange-cyberdefense.github.io/GOAD](https://orange-cyberdefense.github.io/GOAD/) - **The Hacker Recipes, Password Spraying:** [thehacker.recipes/ad/movement/credentials/bruteforcing/spraying](https://www.thehacker.recipes/ad/movement/credentials/bruteforcing/spraying) - **HackTricks, Password Spraying:** [book.hacktricks.xyz](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/password-spraying) - **NetExec documentation:** [netexec.wiki](https://www.netexec.wiki/) - **MITRE ATT&CK, Password Spraying (T1110.003):** [attack.mitre.org/techniques/T1110/003](https://attack.mitre.org/techniques/T1110/003/)