Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?

I've found some through Google, but I’m interested in hearing about where you get your dictionaries from.

share|improve this question
3  
Note that "dictionary attack" is not exactly the same thing as "brute force attack"... –  AviD Dec 29 '10 at 16:10
    
Thank you Avid. You are ofcourse right! –  Chris Andrè Dale Dec 29 '10 at 21:27
1  
Not an answer, but in a pinch you could always grab the linux dictionary file, it's normally there. –  Incognito Dec 29 '10 at 23:06
2  
What are you using it for? –  George Bailey Dec 29 '10 at 23:21
    
@GeorgeBailey, penetration testing. –  Chris Andrè Dale Feb 20 '12 at 12:55

8 Answers 8

up vote 31 down vote accepted

Nice list collected by Ron Bowes you can find here: http://www.skullsecurity.org/wiki/index.php/Passwords. Other list is from InsidePro: http://www.insidepro.com/eng/download.shtml.

share|improve this answer

Some additional ones to add to those already suggested

share|improve this answer

An important one that hasn't been added to the list is the crackstation wordlist

The list contains every wordlist, dictionary, and password database leak that I could find on the internet (and I spent a LOT of time looking). It also contains every word in the Wikipedia databases (pages-articles, retrieved 2010, all languages) as well as lots of books from Project Gutenberg. It also includes the passwords from some low-profile database breaches that were being sold in the underground years ago.

Best thing is, its free, although you can (and should!) make a donation!

share|improve this answer
1  
Thanks D3C4FF,<br> 4GB + wordlist? Wow thanks for sharing that!<br> And thanks Crackstation.net ....<br> Sorry, I dont have any money to donate right now... but i have bookmarked you and you will get your donation in the future...<br> Worth every penny! Thanks Again Vishnu –  user26839 Jun 7 '13 at 12:39
    
@user26839 if it was useful, please don't forget to upvote :) Stick around and don't forget to read the FAQ –  NULLZ Jun 7 '13 at 15:17

The CrackLib dictionaries: http://linux.maruhn.com/sec/cracklib-dicts.html

share|improve this answer

i was testing the likely-hood of collisions of different hashing functions. To help test that i tried hashing

  • all 216,553 words in the english language. Start with those 17.7 bits.

  • then the list of all 2,165,530 english words with one digit after it. (21.0 bits)

  • then the list of all 21,655,300 enligsh words with two digits after it. (24.4 bits)

  • then the list of all 524,058,260 english words with a possible capital as the first letter, and followed by zero, one, or two digits. (29.0 bits).

With one list of english words you'll cover nearly everyone's password.

Note: XKCD is always relavent

share|improve this answer
    
I have no idea why you got downvoted. This is the most relevant answer. –  Cayetano Gonçalves Apr 5 '13 at 20:11
    
When cracking, these permutations (adding a digit, capitalizing) are usually done with "rules". For example, Hashcat takes a given dictionary and applies a user-defined set of rules (hashcat.net/wiki/doku.php?id=rule_based_attack). This allows a trade-off between disk space and processor resources. –  mcgyver5 Mar 10 at 12:19
    
Your second link (all words in the English language) gives a 404 now, but it has been archived by the WayBack machine. –  ComFreek Jun 7 at 9:18

You'll find lots of words in lots of languages on the download page for the English Wiktionary. enwiktionary-latest-all-titles-in-ns0.gz contains just page titles, including phrases - it might have underscores instead of spaces though. (we have English definitions of words from many languages).

And of course there's also WordNet.

(sorry but as a newbie I can only include one link)

share|improve this answer

Another good source is here http://g0tmi1k.blogspot.com/2011/06/dictionaries-wordlists.html

snippet:

[Analysis] Dictionaries & Wordlists
In general, it's said that using a GOOD 'dictionary' or 'wordlist' (as far as I know, they're the same!) is 'key'. But what makes them GOOD? Most people will say 'the bigger, the better'; however, this isn't always the case... (for the record this isn't my opinion on the matter - more on this later).

share|improve this answer

All the posts so far have great information, but remember you can always generate word lists yourself with a utility like crunch.

If you have an idea of what the password parameters are (for example, has to be 8-10 chars with only letters and numbers, no symbols), you can pipe crunch to most bruteforce programs with the tailored parameters.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.