Spraying Attack

Updated 31 Jul 2026

•
def
- •
  a password attack that tries one common password (e.g., "Summer2024!") across many different user accounts, rather than trying many passwords against one account
•
why it works
- •
  avoids triggering per-account lockout policies, since each individual account only receives one login attempt
•
related
- •
  Brute Force (Password Attack)
- •
  Account Lockout
•
cards
- •
  How does a spraying attack avoid triggering account lockouts?
  - •
    It tries one common password acoss many accounts, rather than many passwords against one account, so no single account gets multiple failed attempts

Linked references 3