> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/external-pentest-playbook/attacking-login-portals.md).

# Attacking Login Portals

## Overview and Strategy

At this point you should have identified **Login portals to attack, List of possible employees/emails and Password strategies to employ.** An easy login portal to identify is the **Office365** one.

Identifying the **Password Policy** is very important for choosing a password spraying strategy. For the most part we assume Upper/Lower case, Numbers and Special Characters.

What's the name of the company? Are they in a major city? Any big sports teams there? What's the address of the company? Any local colleges people attended? Maybe they're using [**leet speak**](https://www.techtarget.com/whatis/definition/leet-speak-leet-leetspeak-leetspeek-or-hakspeak)**.**

We need to use the password strategies with the highest probability first and work our way down.

{% hint style="info" %}
A common password combination is the current **Season**, **Year (2024 / 24)** and a **Special Character.** You might have to back date it if the passwords aren't changed often.
{% endhint %}

## Content

* [Password Spraying O365](/external-pentest-playbook/attacking-login-portals/password-spraying-o365.md)
* [Password Spraying OWA](/external-pentest-playbook/attacking-login-portals/password-spraying-owa.md)
* [Attacking Other Portals](/external-pentest-playbook/attacking-login-portals/attacking-other-portals.md)
* [Bypassing MFA](/external-pentest-playbook/attacking-login-portals/bypassing-mfa.md)