Spraying Attack

A password-spraying attack is a specific kind of attack that uses an individual password that is commonly used with multiple accounts using the same application. This is opposite to what a typical brute-force attack looks like since the attacker is not trying with different passwords for only one account. The reason why attackers sometimes prefer this technique is because they avoid the lockout that is usually set with most applications when trying a password multiple times.

A password-spraying attack typically will take place in several steps.

1. First of all, the attacker will acquire a list of all the usernames. This can often be found on the internet or by employees accidentally leaking it without knowing about password-spraying attacks.
2. Once the attacker has obtained the list of all usernames, he will attempt the login process using the list with all usernames but only using one password.
3. If not successful, the attacker will then repeat the procedure with a new password until access is granted to one of the accounts.

Password spraying is a specific type of brute force attack that takes a different approach from traditional brute force attacks, which try to guess a password for a single account. Even though it’s different from the most common brute-force attacks, password spraying still leverages the traditional trial-and-error approach that is typical of brute-force attacks.