password-spray

Refactored & improved CredKing password spraying tool, uses FireProx APIs to rotate IP addresses, stay anonymous, and beat throttling

Username enumeration and password spraying tool aimed at Microsoft O365.

Python3 tool to perform password spraying using RDP

A SOCKS proxy written in Python that randomizes your source IP address. Round-robin your evil packets through SSH tunnels or give them billions of unique source addresses!

Spray365 makes spraying Microsoft accounts (Office 365 / Azure AD) easy through its customizable two-step password spraying approach. The built-in execution plan features options that attempt to bypass Azure Smart Lockout and insecure conditional access policies.

Modular Enumeration and Password Spraying Framework

DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. It will automatically generate a userlist from the domain which excludes accounts that are expired, disabled locked out, or within 1 lockout attempt.

PurpleSpray is an adversary simulation tool that executes password spray behavior under different scenarios and conditions with the purpose of generating attack telemetry in properly monitored Windows enterprise environments

Fast multithreaded multiplatform password spraying tool designed for easy use. Supports webhooks, jitter, delay, files, rotation, backend database

Perform various SMB-related attacks, particularly useful for testing large Active Directory environments.

Multi-protocol credential validation tool with spray and no-spray modes for penetration testing.

CTF-focused password spray wordlist generator. Perfected for OSCP/PNPT/CPTS. Generates realistic seasonal passwords without the bloat of other existing tools.

Mass Social Engineering tool and Email and Account Extraction (Random Brute Force Discovery) and Password Brute Force through Tor.

A script designed to test passwords against user accounts within an Active Directory environment, offering customizable Account Lockout Threshold and a Reset Account Lockout Counter.

An extensible Rust-based exploitation framework designed to audit/attack AzureAD environments.

Explainable K2,4 biclique witness detection CLI and API for distributed password spray and authentication abuse.

Multi-protocol password-spraying utility

Generate list of possible usernames for attacks such as password spraying

Next-generation enterprise SOC detection layer countering Midnight Blizzard (NOBELIUM) distributed password sprays. Correlates low-and-slow VPN auth telemetry using bipartite graph Union-Find clustering, multi-family consensus arithmetic, and SHA-256 tamper-evident ledgers. Native Sentinel & STIX 2.1 integration. Built for Microsoft Innovate 2026.