A penetration tester is evaluating the security of a corporate client’s web application using federated...

PenTest+ differentiates password spraying from brute-force attacks. Brute force (as shown in A, C, and D) rapidly tests many passwords per user, producing a high rate of failed logins that commonly triggers defensive controls such as rate limiting, account lockout policies, WAF/IDS alerts, and IP reputation blocks. This is especially true in federated authentication flows, where identity providers and reverse proxies log and correlate repeated failures.

Option B reflects a spraying approach that is designed to be low-and-slow and policy-aware. A spraying tool that supports building an execution plan and adding delays between authentication attempts reduces the likelihood of crossing thresholds that cause automated blocking. In PenTest+ terms, this aligns with conducting authentication testing in a controlled manner to avoid service disruption and to minimize detection while still validating whether weak or reused passwords exist.

Therefore, the spraying approach with built-in pacing and planning has the least likelihood of getting the tester’s IP blocked compared to high-volume brute-force loops or Hydra-style rapid attacks.