Pentest List Wiki
  • What is Pentest List Wiki?
  • OFFENSIVE SECURITY
    • External Infrastructure
      • Discovery
        • Email Address Discovery
        • Subdomain Discovery
        • Data Discovery
        • Port & Service Discovery
      • Exploitation
        • Password Spraying
        • Vulnerability Scanning
    • Internal Infrastructure
      • General Discovery
        • AD Attack Path Discovery
        • Port & Service Discovery
      • Credential Discovery
        • Passwords and NetNTLM
        • SAM & LSA secrets
        • NTDS.dit secrets
        • LSASS secrets
        • DCSync
        • DPAPI secrets
      • Movement
        • Credential Spraying
        • SMB Relaying
        • Pass The Hash
      • Infiltration/Exfiltration
        • Pivoting (Proxying)
    • Web Application
      • Discovery
        • Testing API Keys
        • Vulnerability Scan
        • Web Content Discovery
        • Parameter Discovery
        • VHOST Discovery
        • CMS Scanners
      • Exploitation
        • Authentication
          • Email Address Forms
          • AWS Cognito
        • JSON Web Tokens
        • Injection Attacks
          • SQL Injection
          • Cross-Site Scripting
          • HTTP Headers
      • Bypasses
        • Cloudflare Bypass
        • HTTP 403 Bypass
    • Mobile (iOS/Android)
      • iOS
        • IPA Decryption
        • Filesystem Analysis
        • Static Analysis
    • Cloud
      • AWS
        • Vulnerability Scanners
        • S3 Buckets
      • Azure
        • Vulnerability Scanners
        • m365 & Entra ID
  • DEFENSIVE SECURITY
    • Forged Kerberos Tickets
    • Logon Event Visualisation
Powered by GitBook
On this page
  • Valid Credential Spraying
  • Known Password Spraying
  1. OFFENSIVE SECURITY
  2. Internal Infrastructure
  3. Movement

Credential Spraying

How to find and use internal credentials.

PreviousMovementNextSMB Relaying

Last updated 11 months ago

Valid Credential Spraying

When at least one valid username and password combination has been identified, valid credential spraying can be used to find where the account can login and find any escalated privileges.

NetExec can be used to perform the password spray, where the valid credentials are used across a subnet of workstations to validate if the user can login and if they have any escalated privileges:

nxc smb <target_ip/range> -d <domain> -u <username> -p <password>

Known Password Spraying

When a valid password has been identified or you have made an educated guess, you may want to spray the password against a range of accounts to find any successful credential combinations.

NetExec can be used to perform the spray, where the password is used across a list of users to validate if the user and password combination is valid:

nxc smb <target_ip> -d <domain> -u <users.txt> -p <password>

https://github.com/Pennyw0rth/NetExec
https://github.com/Pennyw0rth/NetExec