Password Attacks

Table of Contents

See also Pass-the-Hash.

Default Passwords

Look into the product’s documentation.

Hash Types

hashid – Already in Kali Linux

hashid 'd8e8fca2dc0f896fd7cb4cb0031ba249'

Hash Generator

Extracting Hash

Wordlists

Usernames

WordlistSourceDescription
names.txtSecLists
top-usernames-shortlist.txtSecLists
cirt-default-usernames.txtSecLists
xato-net-10-million-usernames.txtSecListsLOWERCASE, APPLY RULES
The Xato database is a collection of compromised passwords obtain through various data breaches and leaks.
xato-net-10-million-usernames-10000.txtGitHubTop 10000 of the xato-net-10-million-usernames.txt file. GitHub from Lisandre.com.
unix_users.txtMetasploitKali Linux:
/usr/share/metasploit-framework/data/wordlists/unix_users.txt

Passwords

WordlistSourceDescription
rockyou.txt.tar.gzSecListsPasswords from leaked database, 2010.
Also included in Kali Linux:
/usr/share/wordlists/rockyou.txt.gz
best1050.txtSecLists
xato-net-10-million-passwords-10000.txtSecListsLOWERCASE, APPLY RULES
The Xato database is a collection of compromised passwords obtain through various data breaches and leaks.
Top 10,000 most common passwords, represents 99.8% of all user passwords when ignoring case (Wired).
Top304Thousand-probable-v2.txt *GitHub
richelieu-french-top20000.txt *SecListsMost common French passwords. It’s based on well known and public dataleaks in France (“.fr” email addresses).
quebec.txtGitHubBreaches of Quebec companies/institutions
lang-french-full.txt
lang-french-small.txt		SecListsFrench dictionary
lang-english.txtSecListsEnglish dictionary
nerdlist.txtGitHubCommon passwords for geeks or admin
Security-Question-AnswersSecListsMany files like cities, dates, streets, zip codes, etc.
RockYou2021.txt *GitHubHUGE: 82 billion unique entries
combination of all passwords (6-20 chars)
CrackstationCrackstation
Weakpass *WeakpassRepository of wordlists
WordlistsGitHubRepository of wordlists (Lisandre.com)
Passwords *SkullSecurityRepository of wordlists
Password lists, * Seen during a demo

rockyou.txt

Passwords from leaked database, 2010.

wget https://github.com/danielmiessler/SecLists/raw/master/Passwords/Leaked-Databases/rockyou.txt.tar.gz
gunzip -dk rockyou.txt.tar.gz
tar xvf rockyou.txt.tar

Kali Linux

This wordlist comes with Kali Linux. Uncompress it.

cd /usr/share/wordlists/
sudo gunzip -dk rockyou.txt.gz

Some tools require an UTF-8 version of rockyou. Convert to UTF-8.

iconv -f ISO-8859-1 -t UTF-8 /usr/share/wordlists/rockyou.txt > rockyou_utf8.txt

Fuzzing

Generate wordlists

Generate dates

Adjust the start date and number of days as needed.

for i in $(seq 0 364); do date -d "2026-01-01 +$i day" +%Y%m%d; done

Generate a list based on a regular expression

sudo pip3 install exrex
exrex "(/v[12])?(/(api|swagger|openapi))?/(api-docs(\.json)?|swagger(-ui(-openapi)?)?\.html|openapi\.html)"
exrex "(A|a)lice(\d)?@(B|b)ob(\d)?"

Cracking Passwords

Online Attack

Offline Attack

Password Spray Attack / Reverse Brute Force Attack

Try same common password against many accounts, bypass locking

Reference