Credential Reuse & Password Spraying

You have obtained a set of credentials during an engagement. Plan how to maximize their value across the environment.

**Credential Validation**
- How do you quickly validate credentials against multiple services without triggering lockouts?
- What is the difference between password spraying and credential stuffing?
- How do you estimate the lockout threshold of a target before spraying?

**Reuse Targeting**
- Which services should you test discovered credentials against? (SMB, WinRM, SSH, RDP, MSSQL, web portals, VPN)
- How do you prioritize which users to spray first?
- What does a pattern of "same password across multiple accounts" tell you about the organization's password policy?

**Hash Reuse (Pass-the-Hash)**
- What is Pass-the-Hash (PtH) and which protocols support it?
- If you have an NTLM hash but not the plaintext, where can you use it directly?
- What is the difference between PtH and Pass-the-Ticket?

**Spray Execution**
- How do you configure crackmapexec for a safe spray cadence?
- What output tells you a credential is valid vs the user exists vs lockout hit?
- How do you handle a domain with multiple OUs that have different lockout policies?

**Local Admin Reuse**
- Why is local administrator password reuse such a common lateral movement vector?
- What does crackmapexec `--local-auth` tell you about local admin password reuse across machines?

Output:
- Safe spraying cadence formula
- Per-service credential testing commands
- Credential reuse decision tree