Why Password Spraying Works and How to Not Lock Out 3,000 Accounts

#One Password. Thousands of Users. Zero Lockouts (If You're Smart).#link

Password spraying is not brute force. Brute force hammers one account with thousands of passwords. Spraying tries one password against thousands of accounts. The math favors you because humans are predictable. In any organization over 500 users, at least 2-3% will use Welcome1, Spring2024!, or Password123. That's 10-15 compromised accounts from a single spray attempt.

But here's what separates a professional from a script kiddie: understanding the password policy BEFORE you spray. I cannot stress this enough. Spray blind and you WILL lock out accounts. Lock out the CEO's account at 2am and your engagement is over. Not figuratively. Literally. I've seen it happen.

What must you know before executing a single spray attempt?

Eight character minimum. Complexity enabled. Lockout at 5 attempts. Auto-unlock after 30 minutes. This is the default Windows Server policy that roughly 60% of organizations never change. It's a gift. You can spray Welcome1, Spring2024!, and Fall2024! across all 2,900 users with 31-minute gaps between each, and you won't lock out a single account.

What passwords should you actually spray?

Think like a lazy user meeting a complexity requirement. They need uppercase, lowercase, number, and optionally special char. The path of least resistance: a common word, capitalized, with a number appended. Season + Year + special character is the single most common pattern in enterprise environments. Spring@2024, Welcome1, Password123, CompanyName1!. If you know the company name, try variations of it.

Strategy is set. Policy is understood. Target list is built. Now you execute. And you execute carefully, because there's no undo button on a mass account lockout.