> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/external-pentest-playbook/attacking-login-portals/password-spraying-owa.md).
# Password Spraying OWA
## Overview
**Outlook Web Access** is the on-premise **Exchange Mail server.** It is possible to pull quite a bit of information from the organization even if we don't fully break into it
OWA Login page
## Attacking OWA with Metasploit
Password Spraying with auxiliary module
```q
use auxiliary/scanner/http/owa_login
set user_file users.txt
set password Winter24!
```
{% hint style="info" %}
You may need to change the Auxiliary Action to the appropriate version
```bash
set action OWA_2016
```
{% endhint %}
If the account is valid the server will get back to you faster than if the account is invalid. Metasploit has a builtin detection mechanism for this and saves the valid user accounts
Valid username example
{% hint style="warning" %}
Metasploit won't stop if you continuously lock out accounts althought it will tell you if an account is locked out. Be sure to monitor it
{% endhint %}
When there's a successful login, Metasploit will give you the I**nternal Domain** and **naming system and convention** because we are using **Active Directory** credentials to login