I am looking for resources like a hash cracking competition, but offline. More like a practice list of specifically crafted "passwords" hashed for the purpose of testing various cracking techniques. Currently I am ranking the runtime and effectiveness of mask-based attacks and plan on learning to write JtR/Hashcat rules.

Is there any "yard stick" for effectiveness of wordlists/rules/masks?


You've got the right idea - this is a great way to learn.

For beginning and intermediate cracking, the best general password lists are actual lists of passwords - those found in leaks with large general user bases. And the best general practice hash lists are the hashes from public leaks.

Your best "bang for the buck", in my opinion, is the hashes.org "left" and "found" lists (the "founds" are combined in multiple archive files at the bottom of the page). The older lists are "frozen" after the year is over, so once you download the older ones, you only have to download this year's once in a while.) You'll also see some "junk" archives listed there. They are less efficient, but can also be interesting to play with after you exhaust other attacks.)

For benchmarking, the Weakpass wordlist index compares wordlist efficacy using the best64 ruleset against a few targets. In that list, you can see that general efficiency compared to the size of the list is quite good for the combined hashes.org list. (But download it directly from hashes.org to get the newest).

Beyond hashes.org, all other human-generated strings are great fodder, including:

  • wordlists from Wikipedia, Wikia, etc. (See sraveau's work on this)
  • Usernames and email address (left-hand user portion) from leaks
  • lists of given names and surnames (there is a Facebook corpus out there)
  • dictionaries in foreign languages (preferably UTF-8 encoded)
  • street names, band names, song names
  • predictable already-memorized sequences (dates, phone numbers, SSNs ...)
  • etc. (anything else people already remember)

See also SkullSecurity's password page for some good leads, and g0tmi1k's attack efficiency testing, which sounds similar to what you're planning.

  • Awesome, that's basically what I've been doing. I'd found the SkullSecurity page but the rest is new to me. – virullius Sep 14 '17 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.