As explained in the previous blogs many people use a word followed by a rule like add special and digit. Or use a word and replace character with digit or special character.
In the first blog the 10.000 word list was used.
This blog will make you aware of the existence of far more word lists and how to counter these.
Wordlists
Wordlists available:
- Dictionaries for each language, like Webster for English. Each language has their own preferred dictionary
- Keyboard walk list: contains fragments like QWER, UIOP, ASDF etc. These fragments are used in so-called combination attacks by using multiple fragments like: Qwer1234!@#$ (which is 3 keyboard walks)
- Wikipedia list; this list is huge and simply contains a list of ALL words ever used on Wikipedia
- Public site or intranet site keywords; comparable to Wikipedia, but targeted towards a single organization. Many people use the company name, department name, project name or another internal name as part of their password
- All placenames (cities, provinces, states, countries, rivers, etc) in the world
- All movies, actors, actrices, characters
- Sport names and sports players
- Lists from previous password hacks: like the LinkedIn list, RockYou list, etc.
The creator of John The Ripper offers them for money on their site (for cracking, still use hascat…).
Counter measures for attacks done by word lists
Counter measures:
- User education to use not a single word, but two or more words in the password
- Use single sign on in stead of passwords
- Use generated passwords in secure storage