Password Spray

In an authorized assessment, test one approved common-password candidate against multiple in-scope accounts on a specific reachable service. Password spraying uses a single or small set of candidates across many accounts, rather than many guesses against one account. A successful authentication validates only that account and service under the tested authentication context; it does not establish access to other services.