credential-attack

CREDENTIAL ATTACK PIPELINE

Real-world initial-access vector. Verizon DBIR consistently ranks Stolen Credentials in the top 3 incident types. Most BB hunters skip this because they only try rockyou.txt and get rate-limited.

Core principle: humans pick lazy passwords. {CompanyName}{Year}!, {ProductName}{Season}, {City}123. Harvesting company-specific vocabulary (product names, office cities, internal project codes) before spraying is what makes the hit-rate go from 0.01% to 1%+.

This skill covers WHEN to use credential attack, HOW to chain the 4 commands, and the legal/operational guardrails.

---

WHEN TO RUN CREDENTIAL ATTACK

Credential attack is a parallel branch to /hunt, not a replacement. Both come after /recon:

/recon ──┬──▶ /hunt (web vuln scan)         ──┐
         │                                     ├──▶ /validate ──▶ /report
         └──▶ /wordlist-gen → ... → /spray  ──┘

Run it when:

• Target has a discoverable login endpoint (web form / O365 / Okta / OAuth)
• Program scope explicitly permits authentication testing or credential testing
• You can stomach a 30-min-to-multi-hour run (with conservative defaults)

Skip it when:

• Program policy lists "credential stuffing", "brute force", or "password attacks" as out-of-scope (this is the majority)
• Target only has SSO via a provider you don't control (e.g., "Login with Google")
• The login endpoint is rate-limited so aggressively that even 1 attempt/30min triggers alerts

KILL signals (don't even start):

• No login surface in recon output
• WAF (Cloudflare with Bot Management, Akamai) on every auth endpoint
• Program runs an active red-team — they'll see your spray immediately
• You don't have a clean wordlist yet (running rockyou.txt is a waste of lockouts)

---

THE 4-STAGE PIPELINE

/wordlist-gen     ──▶  /breach-check     ──▶  /osint-employees   ──▶  /spray
(company words)        (rank by HIBP)         (real usernames)         (live attempts)