Definition
Password spraying is a brute-force attack technique where an attacker attempts a single common password against many different user accounts. This method is designed to bypass account lockout mechanisms that might trigger after a few failed login attempts on a single account. The attacker systematically tries one password, such as 'password123' or 'Winter2023', across a wide range of usernames. This approach is effective against organizations with weak password policies or a high prevalence of default credentials. For instance, an attacker might use a list of common passwords against all employee accounts in a company directory. Unlike password guessing, which targets a single account with many passwords, password spraying targets many accounts with one password. This concept is frequently tested on CompTIA Security+ and CISSP examinations.