Lion Cipher Lab
Defend against password spraying
- Identity & Access Management
- Beginner
- ~30 min
- Free · no account required
Why it matters
Password spraying is one of the most common ways real intrusions begin, and it is built specifically to defeat the first defense most teams reach for. Instead of guessing many passwords against one account (which lockout policies catch), the attacker takes ONE password most people would never choose well — a season and year, a company name, 'Password1' — and tries it against a whole directory of usernames, one attempt each, slowly, from changing sources. No single account crosses a lockout threshold, so nothing obvious alarms. Understanding this attack turns identity from a checkbox into…
What you'll learn
- understanding password spraying vs brute force
- reading authentication logs for a spray signature
- counting distinct targeted accounts per source
- why MFA is the primary defense
- banning breached and common passwords
- smart lockout and throttling by source
- recognising lockout-only policies as a DoS risk
Steps in this lab
- One password, many doors: what spraying is
- Why it slips past lockouts
- Get your own auth log in front of you
- The spray signature: one source, many usernames
- Confirm it is low-and-slow, and cross-check the journal
- Defense #1: MFA everywhere
- Defense #2 & #3: ban weak/breached passwords, then throttle smart
- The honest bottom line