Top tools for password-spraying attacks in active directory networks

Password guessing is essentially an art form when this attack is performed on a large scale against a large group of users. Password spraying attacks are part of this landscape, and they can be carried out in different situations, including active directory networks. In short, this attack attempts to authenticate into many user accounts using the same password. Because of this, corporate networks are often targeted, as obtaining usernames from a company can be an easy task these days with the help of OSINT techniques simply by using social networks such as LinkedIn or Facebook.

According to Microsoft, the three steps to conduct a password-spraying attack are:

Acquire a list of usernames: starting with a list of names: firstname.lastname@company.com Spray passwords: testing popular and common passwords (123456, password, and Winter21!). See the top 10,000 passwords. ) Gain access: one of the tested attempts works, and the account can be abused to enumerate assets in the AD network, exploit authenticated services and put the organization at risk.

Figure 1: Workflow where the password “Summer2016” was spread against an Active Directory network. The user “Glen” was a match, and privileged access over the corporate network was obtained.

Popular tools

Read More: https://resources.infosecinstitute.com/topic/top-tools-for-password-spraying-attacks-in-active-directory-networks/