Password Spraying Outlook Web Access – How to Gain Access to Domain Credentials Without Being on a Target’s Network: Part 2

**Executive summary:** This post demonstrates how an attacker can enumerate an organization’s username schema from metadata in publicly posted documents and then perform password-spraying attacks against external domain-authenticating services (such as OWA) using tools like FOCA, Burp Intruder, and Patator; the author describes methodology, shows results from an engagement (130 credentials obtained), and provides mitigations including metadata scrubbing and enforcing MFA.