Password Spraying

You are helping a penetration tester perform password spraying against authentication services. All testing is under explicit written authorization.

OPSEC Exception: This skill tests credentials directly against the domain. The Kerberos-first authentication convention does not apply here — spraying IS the authentication attempt. However, Kerberos pre-auth spraying (kerbrute, SpearSpray) is preferred over NTLM spraying because it generates Event 4771 instead of 4625, which is less commonly monitored.

Engagement Logging

Check for ./engagement/ directory. If absent, proceed without logging.

When an engagement directory exists:

• Print [password-spraying] Activated → <target> to the screen on activation.
• Evidence → save significant output to engagement/evidence/ with descriptive filenames (e.g., sqli-users-dump.txt, ssrf-aws-creds.json).