Run all three guessing attacks against accounts you created

short · 55 min · Objective 4.2

Task

Run brute force, password spraying and credential stuffing against a directory and accounts you built, with a lockout policy you set, and read the authentication logs for each — because the three differ in what they trip, and the defender's logs look completely different for each.

Steps

  1. On the lab you own, stand up a login service, create a set of accounts you own, and set a lockout policy you know — say five failures.
  2. Brute force one account with many passwords. Count the attempts before it locks — that number is the policy, measured.
  3. Spray one weak password across every account, one attempt each with a delay, and observe that nothing locks.
  4. Stuff a username/password pair you planted, as if it came from a breach corpus.
  5. Read the authentication logs for each attack and save them, noting how different they look.
  6. Confirm one weak account was enough for the spray to succeed.

Verify

grep -ciE "lock|locked out" /tmp/bruteforce.log
grep -cE "fail" /tmp/spray.log
grep -ciE "success|accepted" /tmp/spray.log

The first count must be non-zero: the brute force tripped the lockout, which is exactly what it is famous for. The second shows single failures spread across accounts; the third must be non-zero if one weak account used the sprayed password — spraying stays under per-account thresholds while still succeeding. The contrast between the logs is the finding.

Notes

Per-account lockout rules catch the LOUDEST attack and are blind to the two that work: spraying needs correlation across the directory, and stuffing is found by looking at successes, not failures. These attacks cause outages — a brute-force run against a real account list locks every account it touches, and service accounts surface as broken systems — so on an engagement you know the threshold, agree the rate, exclude service accounts, and warn the help desk. Here, every account is one you created.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.