Password Reuse Exploitation

Password spraying tests one or a small number of commonly used passwords against multiple in-scope domain accounts to assess whether any account accepts them. This Kerberos variant needs a reachable domain controller; it is usable from the Internet only when the authorized Kerberos endpoint is Internet-reachable. Spreading attempts across accounts can reduce per-account failures but does not guarantee avoiding lockouts or detection.