SprayHound

SprayHound is designed for password spraying attacks against Active Directory environments. It enables testers to attempt common passwords across multiple user accounts while minimizing account lockouts through safety mechanisms like thresholds. Integration with Bloodhound allows automatic marking of compromised users as owned and identification of privilege escalation paths to Domain Admins.

Use cases include penetration testing of AD infrastructures, red team operations targeting weak password policies, and auditing for default or seasonal passwords like 'Winter202'. The tool supports single usernames, user lists, and common patterns such as username as password in lower or upper case.

It relies on LDAP for AD queries and authentication attempts, and Neo4j for Bloodhound database interactions, making it suitable for environments with pre-existing Bloodhound data collection.

SprayHound connects to Active Directory via LDAP to query user accounts and perform password spraying attempts, respecting lockout thresholds to avoid disabling accounts. Successful logins are recorded, and compromised users are updated in a Bloodhound Neo4j database as 'owned'. It then analyzes the graph to detect shortest paths from owned users to Domain Admins using Bloodhound's pathfinding capabilities. Options like --unsafe allow spraying on nearly locked accounts, and defaults handle common Neo4j setups.