Passwords under attack

Password guessing comes in two shapes, and defenses that stop one often miss the other. Understand both and you understand most login findings you will ever write.

Brute force vs spraying

Brute force tries many passwords against one account. It is loud — thousands of failures on a single username — and trips every lockout ever built. It still works against accounts with no lockout (service accounts, legacy VPNs, staging logins nobody owns).

Password spraying tries a few common passwords against many accounts. Each account sees two or three failures, under every per-account radar, while the attacker covers the whole directory. This worked for years against organizations without multi-factor authentication, and it is the shape your detection lesson later in this academy teaches you to catch: many accounts, few passwords, one source.

Then there is credential stuffing: replaying username/password pairs stolen from someone else's breach. It bypasses password complexity entirely — the password is correct, just reused. Breach-correlation defenses (have-I-been-pwned style checks at login) exist for exactly this.

The three controls that end it

When you assess logins, check in this order. MFA on every remote login — the single control that kills password attacks outright, including correct passwords. Lockouts with alerting rather than silent counters: lock the account, tell the owner, log the source. Monitoring for the pattern: alert on many-accounts/few-passwords/one-source, not just volume.

An organization with MFA everywhere and imperfect patching beats one with perfect patching and password-only admin logins. Say so in the report, in that order.

Rules for this topic

Never test credentials against systems you are not authorized to test. The technique is identical in labs and in crime; the authorization is the entire difference. In bounty scope, credential attacks are very often explicitly out of scope — read the policy before you touch a login form, and prefer reporting missing MFA as a configuration finding over demonstrating account takeover.

Key takeaways

• Brute force is loud per-account; spraying is quiet per-account but visible across the directory; stuffing reuses stolen pairs.
• Assess logins in order: MFA, lockout-with-alerting, pattern monitoring.
• Credential testing is frequently out of bounty scope — check the policy first.