A Pentester's Guide: Osint, Breach Dumps, and Password Spraying
Not discussed is the antidote for blue teams:- 2FA- Password blacklists- Application Firewall that detects this hijinx (haven't explored this yet - anyone know of a good one?)