Online Password Attacks with Legba: Stuffing, Dictionary, and Spray

Password Management & Cryptography | SEC504 | Jul 2026

Mapped five hosts on 172.30.0.0/24 with nmap, then ran Legba against three. Credential stuffing with a user:pass combo list against HTTP Basic auth on 172.30.0.12 found admin:tiksight in 596 attempts (1.38s). A single-user dictionary attack against MySQL on 172.30.0.64 found root:changeme from the 10k-most-common list. Password spraying against SMB on 172.30.0.155, one password across a username list, found ttidmas:Falsimentis123 and, on a second pass, ptrouel:Falsimentis!. Each attack type used a distinct Legba flag pattern: -C for a combo list, -U user -P wordlist for dictionary, and -U userlist -P singlepassword for spray.

Tools: Legba 0.11.0, Nmap 7.60, Slingshot Linux, CLI

Commands

1. Map the targets

nmap found five hosts: 172.30.0.12 (HTTP), .35 (HTTP), .64 (MySQL), .155 (SMB), .185 (SSH+HTTP). Each service maps to a Legba protocol module, so the scan directly determines which attack to run where.

sudo nmap -sT 172.30.0.2-254

Maps services to the Legba protocol modules to target

2. Inspect the wordlists

The lab provided a combo credentials.txt (user:pass pairs like administrator:password), 10k-most-common.txt, falsimentisusernames.txt, and passwords lists. The combo list is for stuffing; the username list plus a single password is for spraying.

cd ~/labs/passwords/
ls -lah
head credentials.txt

credentials.txt = combo list; falsimentisusernames.txt = spray user list

3. Credential stuffing against HTTP Basic

172.30.0.12 answered with a browser Basic-auth prompt. Legba with -C fed the combo list against the http.basic module. Despite canary-code warnings, it found admin:tiksight in 596 attempts at ~596 requests/sec, runtime 1.38s.

legba -C credentials.txt -T http://172.30.0.12/ http.basic

-C combo.txt: user:pass pairs -T: target http.basic: protocol module

4. Validate and dictionary-attack MySQL

First validated the found credential against MySQL on 172.30.0.64 with -U/-P single values. Then ran a real dictionary attack: -U root -P 10k-most-common.txt found root:changeme in 9,257 attempts at up to ~5,000 requests/sec (3.29s).

legba -U admin -P tiksight -T 172.30.0.64 mysql
legba -U root -P 10k-most-common.txt -T 172.30.0.64 mysql

-U user -P wordlist: single-user dictionary attack

5. Password spraying against SMB

Spraying inverts the flags: -U falsimentisusernames.txt with a single -P password tries one password across every user. -P Falsimentis123 found ttidmas; -P Falsimentis! found ptrouel. Because each account sees only one failed attempt, spraying stays under lockout thresholds that would stop a dictionary attack.

legba -U falsimentisusernames.txt -P Falsimentis123 -T 172.30.0.155 smb
legba -U falsimentisusernames.txt -P 'Falsimentis!' -T 172.30.0.155 smb

-U userlist + -P single = spray; one attempt per account evades lockout

Key Findings

Credential stuffing found admin:tiksight over HTTP Basic in 596 attempts (1.38s)
Dictionary attack found root:changeme over MySQL from the 10k-common list
Password spraying found ttidmas:Falsimentis123 and ptrouel:Falsimentis! over SMB
Spray's one-attempt-per-account shape evades lockout that stops dictionary attacks

Security Controls

MFA to defeat single-credential compromise
Spray detection (failures spread across many accounts)
Breached-password and weak-password screening
Authentication rate limiting on HTTP Basic, MySQL, SMB
Account lockout tuned against spray, not just brute force