A penetration tester is performing a password attack against an Active Directory environment and wants to avoid triggering account lockout policies. Which technique is designed to minimize lockout risk by using a single password against many accounts?

Question

Accepted Answer

B. Password spraying. Password spraying tests a single commonly used password (e.g., 'Welcome1!' or 'Summer2024!') against a large number of user accounts. Because only one or a few attempts are made per account, it typically stays below account lockout thresholds while testing whether any accounts use that common password.

A penetration tester is performing a password attack against an Active Directory environment and wants to avoid triggering account lockout policies. Which technique is designed to minimize lockout risk by using a single password against many accounts?

Related Questions

Discussion