liveBook · Manning

Password spraying

As explained in Grokking Web Application Security

A password-spraying attack tries a small set of commonly used passwords against many accounts or sites to avoid account-specific lockouts.

A password-spraying attack tests a small set of stolen or commonly reused passwords against many accounts or websites. Spreading attempts across targets helps avoid account-specific lockouts while exploiting password reuse. section 1.2

Distinguish password spraying from a related credential attack:

  • Password spraying retests harvested usernames and passwords across many different websites or accounts. section 1.2
  • Credential stuffing targets one site with a large database of stolen passwords at once. section 1.2

How Grokking Web Application Security covers it

How deep it goes
Defines the attack and contrasts it with credential stuffing, without detailing implementation, detection, or response procedures.
Examples
Uses harvested credentials from one service and retests them against many websites as the central attack scenario.
What it assumes
Assumes basic familiarity with usernames, passwords, stolen credentials, and account-based authentication.
What you can do after
Evaluate how password reuse lets attackers expand the impact of stolen usernames and passwords.
How it connects
Connects password spraying with stolen credentials, password reuse, credential stuffing, and data breaches.
Cover of Grokking Web Application Security
liveBookmanning.com
Read Grokking Web Application Security on liveBook Get the book at manning.com

Also explained in

Compare how 2 books explain password spraying →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Grokking Web Application Security. The section links point to the parts of the book it draws on.