~/tutorials/040-guessing-without-the-brute-force.md

040: Guessing, without the brute force

Brute force is the last resort of somebody who did not enumerate. Real password work is aimed: a few good guesses against many accounts, or a wordlist against a hash you already hold. Two different jobs, both quiet, both fast.

This page teaches the aiming. The commands are short because the thinking is long, and every idea below was fired against this site's own login before it was printed.

Spraying

A spray is one password against many accounts. One guess per account per window, under the lockout threshold, on services where the counter is per account.

Why it works is an inventory fact: policy shapes passwords into shapes. Passwords set in autumn carry the year. A policy forcing a symbol appends one. The list of what people actually do to satisfy a policy is short, published, and stable across companies, and a spray walks it.

The guess list for a company that forces ten characters, a digit, and a symbol, in autumn, is three passwords long: the season, the year, the class, in the order people type them. Autumn2026! and its neighbors. That is not a guess about humans, it is a reading of the policy.

Fired against this site's own accounts, five seeded with Autumn2026!:

spray1 -> 200 ok 41ms
spray2 -> 200 ok 38ms
spray3 -> 200 ok 38ms
spray4 -> 200 ok 38ms
spray5 -> 200 ok 39ms

Five accounts opened with one password, and every answer under fifty milliseconds. Nobody was locked out, nothing paged, nothing logged as an outage. That is the whole attack: patience instead of volume.

Note what the spray did not do. It never tried a second password against any account. A spray moves across accounts, not through guesses. The moment you loop passwords against one user, you have left spraying and started brute forcing, and the counter notices.

The counter, read from the code

This site throttles logins, and its numbers are a real defense you can read. Failures are counted per handle in a fifteen minute window. Five failures buys a sixty second wait, eight buys five minutes, twelve buys thirty. The sixth attempt against one account here returns 429, asking you to slow down, instead of 401, telling you the password was wrong.

That ladder is the shape most defenses take, and reading it is the prerequisite for staying under it. The spray above never collected a single failure, because every guess was right. The first wrong guess of a real engagement starts the clock, and a disciplined spray is shaped so the clock never reaches the first rung: one guess per account per window, and the window is longer than the counter's memory.

Some counters are per account, like this one. Some are per source address. Some are global per password, which inverts the whole attack, because one password tried everywhere trips one counter once. Reading which of the three a service uses is the first hour of the work, and the honest answer is usually found in the behavior, not the documentation: fail three times and watch what the fourth answer looks like.

Lockouts are not free

On an engagement, tripping a lockout is not a failed guess. It is a denial of service against a real employee, it pages a real administrator, and it writes your engagement into the incident channel as the outage. Some scopes forbid it outright. All scopes remember it.

The brute force mindset, throw volume until something opens, is how that happens. The spray mindset is the opposite: enumerate the policy, stay under the threshold, stop.

Cracking, which is not guessing

A hash in your hand is offline work. No service is watching, no lockout exists, and the only cost is electricity. The wordlist sets the floor, and the words and the hashes apparatus page carries that lane end to end.

Everything interesting happens above the floor: rules that mutate each word, masks for the pattern policies create, and mangling that turns a month name into a policy compliant password. A GPU walks billions of those an hour, which is why the modern answer to password policy is length, not character classes.

The bridge between the two halves of this lesson is the policy shape. The same Autumn2026! that a spray tries live, a rule file builds offline: a wordlist of seasons, a rule appending four digits and a symbol. Aimed guessing online and aimed cracking offline are the same observation about policy, worn by different tools.

Try it

On this site, register five accounts with Autumn2026! and a sixth with a five word passphrase. Spray the season guess across all six, one guess each, and write down the ratio of what opened to what did not. The passphrase account is the control group.
Read the counter. Send three wrong guesses at one account, then the fourth, and watch the answers change. Then send one wrong guess at five accounts and confirm none of them slow. You have just demonstrated per-handle counting.
The cracking lane is the words and the hashes apparatus page. Run the wordlist pass, then the rules pass, and the second run's success count against the first is the argument for rules.

Reveal the answer

The spray script, the whole thing, in the shape that respects the counter:

$ for user in ann bob cid dee eve; do
    curl -s -X POST https://l1ackers.com/api/login \
      -d "{\"handle\":\"$user\",\"password\":\"Autumn2026!\"}" \
      -H "Content-Type: application/json" -o /dev/null -w "$user %{http_code}\n"
    sleep 2
  done

One password, five handles, two seconds between asks. The sleep 2 is not politeness, it is the discipline: no second guess at any handle, and the spacing keeps you below rate counters that watch per source. Swap the guess each window, never the volume: next window tries Winter2026!, the one after Spring2026!. Three passwords, three windows, five accounts, fifteen guesses total, and a per-account counter that never counted past one.

The defense to write after running it: per-account throttling catches brute force but only logs a spray as fifteen failed logins spread across five people, which no human alert reads. What reads is the correlation, one password failing everywhere at once, which is a detection the soc builds on purpose or does not have.

The defense writes itself from the exercise. Long beats clever, for the person and the attacker both.