PASSWORD SPRAYING WITH SELENIUM AND FIREPROX

Summary from the TLDR InfoSec newsletter

Password spraying attempts can often be hindered by IP based rate limiting. To circumvent this issue, this post walks through the setup of a dynamic proxy using Fireprox as well as Burp Suite Bambdas to modify the request to bypass CSP headers and other rate limiting. The post then concludes by showcasing how Selenium can be combined with the created proxy and crafted request to automate login attempts to achieve a password spraying attack.