CAPEC-565 Password Spraying – Attack Pattern Analysis

CAPEC-565 Metadata

Likelihood of Attack

High

Typical Severity

High

Overview

Summary

In a Password Spraying attack, an adversary tries a small list (e.g. 3-5) of common or expected passwords, often matching the target's complexity policy, against a known list of user accounts to gain valid credentials. The adversary tries a particular password for each user account, before moving onto the next password in the list. This approach assists the adversary in remaining undetected by avoiding rapid or frequent account lockouts. The adversary may then reattempt the process with additional passwords, once enough time has passed to prevent inducing a lockout.

Prerequisites

The system/application uses one factor password based authentication. The system/application does not have a sound password policy that is being enforced. The system/application does not implement an effective password throttling mechanism. The adversary possesses a list of known user accounts on the target system/application.

Execution Flow

Step	Phase	Description	Techniques
1	Explore	[Determine target's password policy] Determine the password policies of the target system/application.	Determine minimum and maximum allowed password lengths. Determine format of allowed passwords (whether they are required or allowed to contain numbers, special characters, etc., or whether they are allowed to contain words from the dictionary). Determine account lockout policy (a strict account lockout policy will prevent brute force attacks).
2	Explore	[Select passwords] Pick the passwords to be used in the attack (e.g. commonly used passwords, passwords tailored to individual users, etc.)	Select passwords based on common use or a particular user's additional details. Select passwords based on the target's password complexity policies.
3	Exploit	[Brute force password] Given the finite space of possible passwords dictated by information determined in the previous steps, try each password for all known user accounts until the target grants access.	Manually or automatically enter the first password for each known user account through the target's interface. In most systems, start with the shortest and simplest possible passwords, because most users tend to select such passwords if allowed to do so. Iterate through the remaining passwords for each known user account.

Potential Solutions / Mitigations

Create a strong password policy and ensure that your system enforces this policy. Implement an intelligent password throttling mechanism. Care must be taken to assure that these mechanisms do not excessively enable account lockout attacks such as CAPEC-2. Leverage multi-factor authentication for all authentication services and prior to granting an entity access to the domain network.

Related Weaknesses (CWE)

CWE ID	Description
CWE-262	Not Using Password Aging
CWE-263	Password Aging with Long Expiration
CWE-307	Improper Restriction of Excessive Authentication Attempts
CWE-308	Use of Single-factor Authentication
CWE-309	Use of Password System for Primary Authentication
CWE-521	Weak Password Requirements
CWE-654	Reliance on a Single Factor in a Security Decision

Related CAPECs

CAPEC ID	Description
CAPEC-49	An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password.
CAPEC-151	Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.
CAPEC-560	An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service.
CAPEC-561	An adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain.
CAPEC-600	An adversary tries known username/password combinations against different systems, applications, or services to gain additional authenticated access. Credential Stuffing attacks rely upon the fact that many users leverage the same username/password combination for multiple systems, applications, and services.
CAPEC-653	An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System.

Taxonomy Mappings

Taxonomy: ATTACK

Entry ID	Entry Name
1110.003	Brute Force:Password Spraying

Stay Ahead of Attack Patterns

Understanding CAPEC patterns helps security professionals anticipate and thwart potential attacks. Leverage these insights to enhance threat modeling, strengthen your software development lifecycle, and train your security teams effectively.