dafthack/DomainPasswordSpray

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

2082 stars · 413 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

DomainPasswordSpray is a PowerShell tool that performs password spray attacks against domain user accounts, automatically generating a user list from the domain. It attempts to detect the account lockout observation window to limit sprays and avoid locking out accounts.

Use cases

• spray a single password across all domain users
• test multiple passwords against Active Directory accounts during a penetration test
• generate a user list from a domain excluding disabled and near-lockout accounts
• avoid account lockouts by respecting the domain lockout observation window
• output successful credential matches to a file

When to choose

• you are doing authorized penetration testing or red teaming against an Active Directory environment
• you need a lightweight PowerShell tool with no dependencies on Windows domain-joined machines
• you want automatic user enumeration and lockout-window-aware spraying

When to avoid

• you do not have explicit authorization to test the domain
• the domain has strict lockout policies and you cannot risk account lockouts
• you need cross-platform tooling outside Windows PowerShell
• you need stealth features like jitter or source-IP masking not provided by this tool

Facets

cli-tool · maturity maintenance

security penetration-testing auth cli security penetration-testing windows windows password-spray active-directory red-team powershell-module offensive-security

Member repositories

For agents

markdown · JSON · MCP: product_card(name="dafthack/DomainPasswordSpray")