credential-attack

# CREDENTIAL ATTACK PIPELINE Real-world initial-access vector. Verizon DBIR consistently ranks Stolen Credentials in the top 3 incident types. Most BB hunters skip this because they only try `rockyou.txt` and get rate-limited. **Core principle:** humans pick lazy passwords. `{CompanyName}{Year}!`, `{ProductName}{Season}`, `{City}123`. Harvesting company-specific vocabulary (product names, office cities, internal project codes) before spraying is what makes the hit-rate go from 0.01% to 1%+. This skill covers WHEN to use credential attack, HOW to chain the 4 commands, and the legal/operational guardrails. --- ## WHEN TO RUN CREDENTIAL ATTACK Credential attack is a **parallel branch** to `/hunt`, not a replacement. Both come after `/recon`: ``` /recon ──┬──▶ /hunt (web vuln scan) ──┐ │ ├──▶ /validate ──▶ /report └──▶ /wordlist-gen → ... → /spray ──┘ ``` **Run it when:** - Target has a discoverable login endpoint (web form / O365 / Okta / OAuth) - Program scope **explicitly permits** authentication testing or credential testing - You can stomach a 30-min-to-multi-hour run (with conservative defaults) **Skip it when:** - Program policy lists "credential stuffing", "brute force", or "password attacks" as out-of-scope (this is the majority) - Target only has SSO via a provider you don't control (e.g., "Login with Google") - The login endpoint is rate-limited so aggressively that even 1 attempt/30min triggers al...