Where can I find good dictionaries for dictionary attacks?

Question

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?

I've found some through Google, but I’m interested in hearing about where you get your dictionaries from.

Answer 1

Nice list collected by Ron Bowes you can find here: http://www.skullsecurity.org/wiki/index.php/Passwords. Other list is from InsidePro: http://www.insidepro.com/eng/download.shtml.

Answer 2

Some additional ones to add to those already suggested

• ftp://ftp.ox.ac.uk/pub/wordlists/ - Lists by language, may be an important point depending on the locations of the users...
• http://www.openwall.com/passwords/wordlists/ - The openwall project lists.
• While not strictly a dictionary site (although it does have some) http://sites.google.com/site/reusablesec/Home/presentations-and-papers has some good presentations on improving the performance of password crackers in general and john the ripper in particular

Answer 3

The CrackLib dictionaries: http://linux.maruhn.com/sec/cracklib-dicts.html

Answer 4

You'll find lots of words in lots of languages on the download page for the English Wiktionary. enwiktionary-latest-all-titles-in-ns0.gz contains just page titles, including phrases - it might have underscores instead of spaces though. (we have English definitions of words from many languages).

And of course there's also WordNet.

(sorry but as a newbie I can only include one link)

Answer 5

Another good source is here http://g0tmi1k.blogspot.com/2011/06/dictionaries-wordlists.html

snippet:

[Analysis] Dictionaries & Wordlists
In general, it's said that using a GOOD 'dictionary' or 'wordlist' (as far as I know, they're the same!) is 'key'. But what makes them GOOD? Most people will say 'the bigger, the better'; however, this isn't always the case... (for the record this isn't my opinion on the matter - more on this later).

Answer 6

All the posts so far have great information, but remember you can always generate word lists yourself with a utility like crunch.

If you have an idea of what the password parameters are (for example, has to be 8-10 chars with only letters and numbers, no symbols), you can pipe crunch to most bruteforce programs with the tailored parameters.

Answer 7

i was testing the likely-hood of collisions of different hashing functions. To help test that i tried hashing

• all 216,553 words in the english language. Start with those 17.7 bits.

• then the list of all 2,165,530 english words with one digit after it. (21.0 bits)

• then the list of all 21,655,300 enligsh words with two digits after it. (24.4 bits)

• then the list of all 524,058,260 english words with a possible capital as the first letter, and followed by zero, one, or two digits. (29.0 bits).

With one list of english words you'll cover nearly everyone's password.

Note: XKCD is always relavent