-1

I have a question similar to this one:

How to create dictionary to prevent weak passwords?

What I want to do though is simply check a list of passwords that exist in a text file I have that contains over 2000 passwords against a known list of words that may appear in a dictionary and/or a list of common names, books, songs, movies, etc..Basically I want to weed out all of the weak passwords so our company can deal with these users according to a new password policy we are putting into place.

Is there a dictionary app or list I can use to accomplish this? The workflow I'm looking for would be something like this:

run app > feed it my text file > app parses through the list to find words that are in its database > output matching results to a new file

How can I accomplish this? It would be nice if I could tap into Linux's built in dictionary check that runs when you set a password with the passwd command, but I have no idea how to do that.

  • Seems like this may be more relevant question for our friends over at stackoverflow as handling a file and parsing through are programmatic actions. – user84662 Aug 17 '16 at 1:36
  • I don't fully disagree about the text processing, but I am asking rather directly about a security app and/or dictionary file and how this could be done in the context of password auditing, which would fall in the realm of infosec. – user53029 Aug 17 '16 at 1:44
  • 1
    Sure I half agree then, your first question is relevant. Check out this question, great references for lists on your 1st question. security.stackexchange.com/questions/9567/… – user84662 Aug 17 '16 at 1:45
  • 1
    Rock You is a password list that has varying length types. github.com/danielmiessler/SecLists/tree/master/Passwords – user84662 Aug 17 '16 at 2:22
  • 1
    1) The fact that you happen to be doing this parsing for a security-related reason is completely irrelevant to the question, so no, this doesn't belong on this site. Try unix.stackexchange.com. 2) grep -F myfile /usr/share/dict/*. 3) Why do you have a plaintext file of your user's passwords? The fact that you have access at all to your user's passwords (i.e. that they weren't one-way hashed with a salt) is a HUGE problem, much larger than anyone using common words. – drewbenn Aug 17 '16 at 17:34
1

I realize you're asking for an app that does everything I'm about to describe, but in lieu of that, I would also consider the following:

  1. Look at SkullSecurity for several password dictionaries and leaked passwords here: https://wiki.skullsecurity.org/Passwords
  2. Read up on using tools like Hashcat for testing password strength using these dictionaries: http://www.makeuseof.com/tag/test-password-strength-tool-hackers-use/
  3. Implement a process tailored to your specific user base whereby you might be able to trigger alerts, generate reports, and such (i.e. routine or random password checks, email notification, etc.). Grep works too, as you've probably seen already.

I'm always an advocate for knowing how to do something 100% by hand before looking to prebuilt apps that may only accomplish 85% of what I need it to do.

  • +1 for the link to the hashcat video. That could also come in handy. – user53029 Aug 17 '16 at 18:08
1

The app would be grep...or comm. Once I chose what list I wanted to compare to my file to, I simply ran:

grep -wo -f mypwordfile rockyoulistfile > pwordmatches

OR if you just want a numeric count or total

grep -wo -f mypwordfile rockyoulistfile | wc -l

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.