SpearSpray — password spraying for Active Directory via Kerberos

The tool is designed for controlled password spraying in AD environments. It combines user enumeration via LDAP with intelligent pattern-based password generation to perform controlled password spraying attacks. Operates via Kerberos pre-authentication to mitigate lockout triggers and ensure the attack remains stealthy.

Features: 📌 LDAP integration for accurate user and group enumeration 📌 Flexible templating system for creating targeted password lists 📌 Awareness of domain policies and PSOs to prevent lockouts 📌 BloodHound support for automatic tagging of compromised accounts 📌 Detailed reporting with statistics

📎 Tool: https://github.com/sikumy/spearspray

💬 Discuss