Password spraying & credential stuffing

When it applies

You have (or can build) a list of valid usernames and a reachable authentication surface, and the engagement authorizes credential attacks. Spraying beats brute force whenever a lockout policy exists — you try one password against every user, not many passwords against one.

Mode gate: this is pentest-only. Nearly every bug-bounty program prohibits brute force, credential stuffing, and anything that risks account lockout or DoS — do not spray on a bounty target. Confirm the lockout policy and testing window in roe.md/scope.txt first (tradecraft-scope-roe).

Why it works

Organizations enforce complexity but not unpredictability: in any large user set, some accounts use Season+Year!, Company@123, or a breach-reused password. Spraying one guess per user per lockout window stays under the counter, so you get many attempts' worth of coverage without tripping lockouts.