Passwords
From charlesreid1
Notes
Experience so far with passwords:
One was a three word phrase (in full rockyou.txt)
Another one was the word "secret", or something or other (in common passwords/short password list)
Latest:
common word + 2 digits (another terrible one - top 1 mil pws, alleged gmail passwords, rockyou)
8 digits, first 6 prime numbers (this one is terrible - top 1 mil pws, alleged gmail, honeynet, md5decryptor, mil-dic, rockyou)
two names put together (in alleged gmail passwords)
Rules gathered from this:
- Make good use of rockyou - it has EVERYTHING.
- Certain numbers are more common, like 33. Certain words match certain patterns. Like, imnumber and a number
- Numbers only - there are lots of numbers-only passwords that are patterns (most in rockyou, lots that are strange). These are basically THE lowest-hanging fruit.
- Appended numbers - start with the easy ones. low-hanging fruit.
Strategies:
- There are a lot of strategies that could be implemented to speed things up and make efficient use of things like common pin numbers, common number pws, common words, etc.
- This was the intention behind some of the scripts I wrote, but those have turned out to be more of a scheduling/maintenance/record-keeping thing, than anything else. It's mainly a collection of dictionaries and rules, used in combination. Use these dictionaries, apply these rules.
- Better approach would involve more stacked/layering. More autonomy.
Ideas
Better implementation:
- Attack with known passwords
- Also attack with generated passwords
To generate:
- Use a series of plain English dictionaries, all lowercase
- Most common 1,000 words, most common 10,000 words
- Cities - sportsball - teams, buildings, boroughs, streets
- Most common 1,000 or 10,000 Spanish/French/German words
- Words + 1 number
- Words + 2 numbers
- Words + 1 number + 1 symbol
- Words + 2 numbers + 2 symbols
- 1 number + words
- 2 numbers + words
- 1 number + 1 symbol + words
- 2 numbers + 2 symbols + words
- Letter + Words + ...
etc...