> For the complete documentation index, see [llms.txt](https://infra.newerasec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infra.newerasec.com/infrastructure-testing/enumeration/services-ports/rds.md).

# RDS

**Password Spraying RDS** 

In order to perform a password spraying attack we first need the internal domain name of the target. This can be found quickly in the RDS logon page source as the WorkSpaceID. 

`curl -s -insecure https://192.168.88.150/RDWeb/Pages/en-US/Login.aspx?returnUrl=/RDWeb/Pages/en-US/Default.aspx`

grep for 'WorkSpaceID'

**Source**:

<https://medium.com/vartai-security/attack-chain-series-remote-access-service-compromise-part-1-rds-e984101c78b7>