Authentication

RDP authenticates with Windows credentials, so it is a brute-force, password-spray, and credential-stuffing target, and a prime landing point for reused and breached passwords. Network Level Authentication changes where credentials are checked but not whether they can be guessed. Valid RDP credentials give an interactive desktop, often with local or domain privilege.

1 phút đọccập nhật 5 thg 10, 2026

1 người đóng góp

RDP logs in with Windows credentials (local or domain), which makes it a direct target for guessing and reuse attacks. Brute force and spraying work against the logon, credential stuffing replays breached username/password pairs, and Network Level Authentication (NLA) moves the check earlier into CredSSP rather than preventing guessing. A successful login creates an interactive session under that account's existing local and domain permissions. Ordinary members of Remote Desktop Users can be authorized to connect without being administrators, so administrative rights and reuse on other systems must be tested separately.

bash

# spray/guess against RDP, respecting lockout (domain\user forms from enumeration)
nxc rdp <target> -u users.txt -p 'Winter2025!'          # marks valid + whether admin
hydra -L users.txt -p 'Winter2025!' rdp://<target> -t 1

Subtopics#

Password brute force: online guessing against the logon.
Credential stuffing: replaying breached and reused credentials.
NLA bypass: Network Level Authentication considerations and misconfigurations.

Authentication

Subtopics#

References#