SEC504 - Hacker Tools, Techniques, and Incident Handling

Online Password Attacks with Legba: Stuffing, Dictionary, and Spray

Solo, Lab

Print command sheet

Focus: Password Management & Cryptography

Level: SEC504

Date: Jul 2026

Artifacts: Sanitized Legba output against HTTP Basic, MySQL, and SMB services from the SEC504 lab (172.30.0.0/24)

TL;DR

•Legba ran three distinct online attacks: credential stuffing (HTTP Basic), dictionary (MySQL), and spray (SMB)
•Credential stuffing found admin:tiksight in 596 attempts in 1.38s against HTTP Basic auth
•Password spraying (one password, many users) beat lockout and found ttidmas:Falsimentis123 over SMB

Skills demonstrated

Multi-protocol online password attacks with LegbaCredential stuffing with combo lists (-C)Single-user dictionary attacks (-U user -P wordlist)Password spraying (-U userlist -P single) to evade lockoutCredential reuse validation across services

Note: Course-provided PCAPs and lab instructions are not shared. Only my own captures and sanitized notes are published.

Why this matters

Password spraying is the attack that beats account lockout, because one password tried across many accounts never trips a per-account threshold, and it is how real intrusions get their first valid credential. Knowing the difference between stuffing, dictionary, and spray, and that they look different in the logs, is what lets a defender build the right detection: stuffing and dictionary spike failures on one account, spraying spreads a few failures across many. Legba makes the taxonomy concrete because the flags map directly to the attack shapes.

Context

This lab uses Legba, a modern multi-protocol credential brute-forcer, to run the three distinct online password attacks against the right targets: credential stuffing against HTTP Basic auth, single-user dictionary against MySQL, and password spraying against SMB. The value is the taxonomy: the same tool, different flag combinations, three fundamentally different attacks with different detection profiles.

Tools used

Legba 0.11.0Nmap 7.60Slingshot LinuxCLI

Steps taken

1Map the targets

nmap found five hosts: 172.30.0.12 (HTTP), .35 (HTTP), .64 (MySQL), .155 (SMB), .185 (SSH+HTTP). Each service maps to a Legba protocol module, so the scan directly determines which attack to run where.

$ sudo nmap -sT 172.30.0.2-254

Maps services to the Legba protocol modules to target

2Inspect the wordlists

The lab provided a combo credentials.txt (user:pass pairs like administrator:password), 10k-most-common.txt, falsimentisusernames.txt, and passwords lists. The combo list is for stuffing; the username list plus a single password is for spraying.

$ cd ~/labs/passwords/
$ ls -lah
$ head credentials.txt

credentials.txt = combo list; falsimentisusernames.txt = spray user list

3Credential stuffing against HTTP Basic

172.30.0.12 answered with a browser Basic-auth prompt. Legba with -C fed the combo list against the http.basic module. Despite canary-code warnings, it found admin:tiksight in 596 attempts at ~596 requests/sec, runtime 1.38s.

$ legba -C credentials.txt -T http://172.30.0.12/ http.basic

-C combo.txtuser:pass pairs

-Ttarget

http.basicprotocol module

4Validate and dictionary-attack MySQL

First validated the found credential against MySQL on 172.30.0.64 with -U/-P single values. Then ran a real dictionary attack: -U root -P 10k-most-common.txt found root:changeme in 9,257 attempts at up to ~5,000 requests/sec (3.29s).

$ legba -U admin -P tiksight -T 172.30.0.64 mysql
$ legba -U root -P 10k-most-common.txt -T 172.30.0.64 mysql

-U user -P wordlistsingle-user dictionary attack

5Password spraying against SMB

Spraying inverts the flags: -U falsimentisusernames.txt with a single -P password tries one password across every user. -P Falsimentis123 found ttidmas; -P Falsimentis! found ptrouel. Because each account sees only one failed attempt, spraying stays under lockout thresholds that would stop a dictionary attack.

$ legba -U falsimentisusernames.txt -P Falsimentis123 -T 172.30.0.155 smb
$ legba -U falsimentisusernames.txt -P 'Falsimentis!' -T 172.30.0.155 smb

-U userlist + -P single = spray; one attempt per account evades lockout

Key findings

Credential stuffing found admin:tiksight over HTTP Basic in 596 attempts (1.38s)

Dictionary attack found root:changeme over MySQL from the 10k-common list

Password spraying found ttidmas:Falsimentis123 and ptrouel:Falsimentis! over SMB

Spray's one-attempt-per-account shape evades lockout that stops dictionary attacks

Outcome / Lessons learned

Ran all three online password attacks with Legba and recovered credentials on each service: admin:tiksight (HTTP Basic, stuffing), root:changeme (MySQL, dictionary), and ttidmas/ptrouel (SMB, spray). The flag patterns made the taxonomy explicit: -C for stuffing, -U user -P list for dictionary, -U list -P single for spray.

Detect spraying by correlating a low number of failures across many accounts in a short window, not just per-account thresholds, since spraying is designed to stay under lockout. Enforce MFA so a single valid password is not sufficient, and kill weak/default passwords (changeme, seasonal patterns) with a password filter and breached-password screening. Rate-limit and alert on HTTP Basic and SMB authentication failures, and disable HTTP Basic in favor of a real auth flow.

Security controls relevant

MFA to defeat single-credential compromise
Spray detection (failures spread across many accounts)
Breached-password and weak-password screening
Authentication rate limiting on HTTP Basic, MySQL, SMB
Account lockout tuned against spray, not just brute force

What I took away from this

Spraying is the attack worth internalizing. A dictionary attack hammers one account and trips lockout; a spray tries one password across hundreds of accounts and each one sees a single failure, so nothing locks. That is why real intrusions start with a spray of a common seasonal password: it is quiet, it beats lockout, and it only needs to work once. Per-account thresholds do not catch it; cross-account correlation does.

The three attacks look different in the logs, and that is the defensive hook. Stuffing and dictionary concentrate failures on one identity; spraying spreads a handful of failures across many. A detection tuned only for repeated failures on a single account is blind to the exact attack most likely to succeed. Legba makes this concrete because the same tool, with three flag patterns, produces three distinct log signatures.