SprayingToolkit

SprayingToolkit provides scripts to perform password spraying attacks against Lync/S4B, OWA, and O365 services. Password spraying involves attempting a single password against many usernames to avoid account lockouts, making it quicker and less detectable than brute-force attacks.

The toolkit includes atomizer for direct spraying over Lync, OWA, or IMAP protocols, spindrift for generating username lists from names, and other utilities like aerosol, vaporizer, and core modules located in /usr/share/sprayingtoolkit. It supports various input formats including user files, password lists, and CSV files.

Use cases include red team assessments targeting Microsoft services where common passwords are suspected across many accounts. It integrates notifications via gchat or slack and offers recon mode for information gathering without spraying.

Atomizer handles spraying by connecting to target domains over protocols for Lync/S4B (likely SIP/HTTPS), OWA (HTTPS), or IMAP (port 993 by default), using multiple threads (default 3) to test passwords against usernames. It supports single passwords, password files with intervals to evade detection, CSV inputs, or user-as-pass spraying. Spindrift generates usernames from name lists by appending domains or formatting (default {f}{last}). Scripts leverage Python libraries like requests-ntlm for NTLM auth, imapclient for IMAP, and boto3 for potential cloud integrations.