Individual skill
password-spray-methodology
End-to-end password spray playbook. User enumeration, lockout detection, password pattern generation, spray execution across all protocols, error code differentials, and engagement discipline. Unifies M365/Entra, Okta, Exchange, Kerberos, SharePoint, XMLRPC, OIDC, and AD SMB/WinRM spraying into one methodology.
redteam/password-spray-methodology/SKILL.md
Source commit 1260244136edc6ae698d76d3d526f503e322778d
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,332
- Repository last updated
- Nov 7, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- bug-bounty Repository topic
- cloud-security Repository topic
- firebase-hacking Repository topic
- hermes-agent Repository topic
- jwt-attacks Repository topic
- offensive-security Repository topic
- penetration-testing Repository topic
- reconnaissance Repository topic
- red-team Repository topic
- security-automation Repository topic
- password Declared skill tag
- spray Declared skill tag
- methodology Declared skill tag
- redteam Declared skill tag
- engineering Derived category
- testing Derived category
- testing-browser Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 21,454 bytesSKILL.mdcore · 21,454 bytesSKILL.mdcore · 21,454 bytesSKILL.mdcore · 21,454 bytesSKILL.mdcore · 21,454 bytesSKILL.mdcore · 21,454 bytesSKILL.mdcore · 21,454 bytesSKILL.mdcore · 21,454 bytesSKILL.mdcore · 21,454 bytesSKILL.mdcore · 21,454 bytesSKILL.mdcore · 21,454 bytesSKILL.mdcore · 21,454 bytesSKILL.mdcore · 21,454 bytes
Read excerpt
# Password Spray Methodology
Password spraying is the highest-ROI credential attack: one (or few) passwords tried against many users. It's quiet, avoids lockouts, and succeeds where traditional brute force fails. This skill consolidates every spray vector, enumeration technique, pattern, and protocol across the entire skill catalog.
**This is a methodology skill.** Protocol-specific details live in their respective skills — cross-reference them for deep dives. This skill covers the **universal spray pipeline** that applies everywhere.
## When to Use
- Starting ANY engagement with a user list but no credentials
- Finding internet-facing login portals (OWA, Okta, ADFS, VPN, SSO, OIDC)
- After `hunt-ntlm-info` reveals AD domain/UPN format — feed into spray
- After `hunt-ldap` enumerates sAMAccountNames — feed into spray
- After `js-secrets-extraction` finds email patterns — feed into spray
- OneDrive 302/404 enum (from `m365-entra-attack`) confirms licensed users — spray them