Password spraying
Password spraying is an attack that tries a small set of commonly used passwords against many accounts to avoid repeated failures on individual accounts.
The Art of Code
Password spraying is a brute-force attack that tries a small set of commonly used passwords across many accounts.
- How it is used
- Flags repeated invalid-credential submissions as a security event requiring logging, monitoring, and immediate attention.
- How deep it goes
- Defines the attack and its detection signal but does not detail attack execution or defensive controls.
- Examples
- Uses repeated invalid login submissions as the concrete signal for a possible attack.
- What you can do after
- Operate/configure logging and monitoring to surface suspected password-spraying activity for immediate response.
Grokking Web Application Security
A password-spraying attack tries a small set of commonly used passwords against many accounts or sites to avoid account-specific lockouts.
- How it is used
- Frames password reuse as a way for attackers to extend stolen credentials across multiple websites and accounts.
- How deep it goes
- Defines the attack and contrasts it with credential stuffing, without detailing implementation, detection, or response procedures.
- Examples
- Uses harvested credentials from one service and retests them against many websites as the central attack scenario.
- What you can do after
- Evaluate how password reuse lets attackers expand the impact of stolen usernames and passwords.
Read how Grokking Web Application Security explains password spraying →
Related concepts
- stolen credentialuses · A stolen credential is an account identifier or authentication secret obtained without the account holder’s authorization.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.