Lockout-Aware Credential Spraying with nimux

Overview

Credential spraying can create account lockouts if it is done without policy awareness. A professional workflow starts by reading lockout policy, limiting attempts, adding delay, and using only approved account and password lists.

nimux includes password policy enumeration and spray safety options such as --spray-delay, --max-attempts-per-user, and --lockout-aware.

Read password and lockout policy

nimux smb dc01.corp.local -d corp.local -u operator -p '<password>' --pass-pol

Save JSON when you need evidence:

nimux smb dc01.corp.local -d corp.local -u operator -p '<password>' \
  --pass-pol \
  --json > password-policy.jsonl

Do not spray until you understand lockout threshold, lockout window, and reset behavior.

Build a conservative validation

Use small lists and conservative controls.

nimux smb @targets.txt -d corp.local \
  -u users.txt \
  -p '<candidate-password>' \
  --lockout-aware \
  --max-attempts-per-user 1 \
  --spray-delay 3000 \
  --json > spray-smb.jsonl

Use WinRM only if remote management authentication testing is in scope:

nimux winrm @hosts.txt -d corp.local \
  -u users.txt \
  -p '<candidate-password>' \
  --lockout-aware \
  --max-attempts-per-user 1 \
  --spray-delay 3000

Validate positives carefully

After a successful authentication, perform one low-impact check.

nimux smb fileserver01.corp.local -d corp.local -u valid.user -p '<password>' --shares

nimux winrm workstation01.corp.local -d corp.local -u valid.user -p '<password>' --cmd whoami

Avoid chaining immediately from a sprayed credential without confirming scope and approvals.

Reporting

Report the policy values, attempt limits, delay, protocol tested, account count, success count, and lockout result. Never publish full password lists in a report unless the customer explicitly requests them.