A Pentester's Guide: Osint, Breach Dumps, and Password Spraying
Not discussed is the antidote for blue teams:<p>- 2FA<p>- Password blacklists<p>- Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)