DomainPasswordSpray is a focused security tool designed to perform enterprise-scale password spraying assessments against Active Directory environments. It automates the process of attempting common or customized passwords against many accounts while respecting timing and throttling controls to reduce obvious lockout noise. The project includes features for credential list management, target selection (users, service accounts, or collections), and configurable rate limits so testers can tune the balance between coverage and stealth. Output formats include summary reports and structured logs to help analysts triage which accounts were hit and where to prioritize defensive follow-up. The codebase is written to be used by penetration testers, red teams, and security assessors in authorized engagements and emphasizes responsible use; the README explicitly warns against unauthorized use and stresses running tests only with permission.
Features
- Configurable password lists and per-password rate controls
- Target selection filters for user groups, OUs, and service account lists
- Adaptive throttling to avoid rapid lockouts and emulate realistic attacker cadence
- Structured logging and exportable reports (CSV/JSON) for triage and evidence
- Integration hooks for SIEM enrichment or automated alerting pipelines
- Built-in safe-use reminders and opt-in guardrails for authorized engagement only
Project Samples
