The sharpspray from iomoath

iomoath / sharpspray Goto Github PK

View Code? Open in Web Editor NEW

Active Directory password spraying tool. Auto fetches user list and avoids potential lockouts.

License: GNU General Public License v3.0

C# 100.00%

sharpspray's People

Contributors

Stargazers

Watchers

sharpspray's Issues

Progress info broken ?

Hi, thanks for your tool.

Is the tool supposed to write to console regularly showing "X attempts were made so far." ?
From what I experienced it's only displayed when all users have been tried, so when you run an attack against a high number of users it feels like there is no progress at all giving you the impression that it's not working (even with verbose flag enabled).

Sample command used (via Cobalt Strike)

[*] The domain password policy observation window is set to 0 minutes.
[*] Setting a 0 minute wait in between sprays.
[*] WARNING - Be very careful not to lock out accounts with the -k --pl option!
[*] Password spraying has begun with 1 passwords
[*] This might take a while depending on the total number of users & passwords.
[*] Now trying password Winter2022! against 47243 users. Current time is 2021-11-24 1:13:41 PM

(I know it's probably not wise to target that many users, but I'm not worried about stealth here)

Recommend Projects