Questions tagged [dictionary]

A dictionary is a list of possible or common password that are used to crack passwords in a brute force attack. Such an attack is known as a dictionary attack.

Filter by
Sorted by
Tagged with
0
votes
1answer
39 views

Incremental charset with no duplicate pair characters

I'm using the following command to generate a wordlist: crunch 8 8 +++ -d 1@,% -z 7z -o wordlist.txt Where -d 1@,% avoids generating of adjacent characters, such as: aa, AA, 11 But this is not ...
0
votes
0answers
41 views

How to create custom brute force dictionary with all digits 0000-9999 with characters before and after? [on hold]

I want to mess around with some brute force stuff. I made a fake login and I want to see if I can create a dictionary that will brute force my own password using only a generic pattern. The pattern ...
1
vote
0answers
64 views

Using John the Ripper with custom encryption function

I have a working script done with python to do dictionary attack on a few hashes import hashlib def main(): print("Starting...") users = [] with open('users.txt') as f: for line ...
13
votes
5answers
8k views

Defense against attacks using dictionaries

Some forms of attacks on passwords use dictionaries. It is safer to use nonsense passwords like YunSUanLin, Artibichoke, etc., which do not seem to pertain to any dictionary?
1
vote
1answer
271 views

Combined-Dictionary attack with hashcat, for 4 words passphrases?

Reading the new advice on password which seems to spead easily (at least in my workplace), I was wondering how to use hashcat for cracking four-word password hashes? Say I have this hash ...
1
vote
1answer
83 views

Is there any methods available other than brute force and dictionary attacks?

I am curious to know about the wifi attacks. And I have known a little bit about brute force attack and dictionary attack. Is there any other methods available other than these two...?
0
votes
2answers
595 views

How long does it take to compute hashes using the MD5 hash algorithm? [closed]

1) If one iteration of MD5 takes x seconds, is it safe to assume that n iterations of MD5 takes n * x seconds? 2) Will salted and unsalted versions of md5 hash algorithms take approximately the same ...
0
votes
0answers
46 views

How to generate a bruteforce list? [duplicate]

I need a rather long dictionary to bruteforce with, following a specific pattern: I need it to combine words using the dictionary, to up to three words. It wouldn't be case sensitive, and it would use ...
1
vote
1answer
100 views

What layer does dictionary attacks take place on?

This may be a stupid question, but I'm fairly new to cyber security and networking and I'm looking into different types of attacks. I was wondering if dictionary attacks only took place on the ...
0
votes
2answers
531 views

Generating multi-word passphrases from a wordlist [closed]

As part of pentesting NT hashes where the underlying passwords are minimum 16 characters of length, I have created a wordlist of common words, sports teams, movies, names, years etc. - inspired by the ...
-1
votes
1answer
877 views

Can brute force or dictionary attacks be detected when using the WiFi protocol?

Can the WiFi protocol recognize when a brute force or dictionary attack on it is occurring? WiFi gives the user an authentication failed message after entering an incorrect WiFi password several times....
2
votes
1answer
596 views

Tools and computer specs for password cracking [closed]

To polish my penetration testing skills I want to attempt to crack NTLM/NTLMv2 hashes (via dictionary/wordlist attack) extracted from Active Directory / SAM database, where the underlying passwords ...
-1
votes
1answer
322 views

Crunch wordlist with different number of words

I'm trying to generate a wordlist, but I need some help with it. Let's say I execute the command: crunch 1 1 -p cat dog cow Crunch will generate the following: catcowdog catdogcow cowcatdog ...
3
votes
1answer
1k views

How to find out Wi-Fi password with dictionary attack without connecting to the Wi-Fi?

I have some specific problem. Is there any possibility how to find out Wi-Fi password with dictionary attack without connecting to the Wi-Fi? I need it for my bachelor thesis, where I am using ...
27
votes
1answer
9k views

How does the attacker know what algorithm and salt to use in a dictionary attack?

I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in ...
2
votes
2answers
901 views

Is it still possible to run an online dictionary attack from a single machine, without anonymisation?

This question concerns dictionary attacks conducted: Over the Internet, using programs like THC Hydra Via protocols such as HTTP, FTP and SMTP I believe I'm right in thinking that: a) due to the ...
0
votes
1answer
353 views

RDP Audit Failures Brute Force Attacks

I need some help on tracking the source of these RDP access attempts on our terminal server. Port 3389 is open on the firewall (I know this is a terrible practice. I don't want to hear advice on ...
3
votes
1answer
140 views

Using a list of three-letter words with variable capitalization as a DiceWare dictionary

This is partly an exercise to see if I understand passphrase generation from a given dictionary using the DiceWare technique. But also for possible personal usage. All three-letter word lists I can ...
1
vote
1answer
381 views

Passwords - extended dictionary vs dictionary attacks

Taking inspiration from Diceware and the other passphrase generators, I took a dictionary of 20k English words and used a script to generate typos of them, resulting in 7M "words", giving 22.7 bits of ...
1
vote
1answer
46 views

How to defend against attacker without affecting other users of same NAT gateway

I am implementing a web service and have a daemon process that notices repeated failed login attempts from any given source. If too many occur the IP address is blocked for a given time. This is ...
7
votes
3answers
5k views

Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?

Assuming a 6-character password uses the mixalphanumeric charset, giving each character a character set of 62 and the entire password a keyspace of 62^6 = 46.6 billion (if my calculations are correct)....
4
votes
2answers
528 views

What's the correct term form a pre-computed table with password/hash pairs?

The table looks like this: 123456 -> asfty18u78t489yh password -> 89y203rupdifhof something -> 2r892389n89rfsd And the idea is that if you have the hash (asfty18u78t489yh), you know ...
1
vote
2answers
811 views

How Generate Custom Dictionary Password list [closed]

I want to generate a password list that has 8 characters like this: Characters are: Pp|Aa|Ss|Ww|o0|Rr|Dd First character only can be Pp, second Aa@, .... to end. How can I make this list using ...
0
votes
1answer
848 views

How to Generate Custom Dictionary For this Password Structure [closed]

I am trying to carry out a dictionary attack for a password that is of this structure: 15 characters Lowercase letters and 0-9 First a five letter word then 4 numbers, then 6 letter word Examples of ...
1
vote
3answers
812 views

Creating a wordlist knowing parameters

I need to crack my own router password. Advantage is that I know possible characters and maximum length. What I need is to create a dictionary. The dictionary should contain all the combos of ...
-2
votes
1answer
440 views

Generating wordlists with upper and lower case with crunch

I'm new to crunch and I want to generate a specific wordlist but I need the appropriate code for it. Let's take 478, 1990, gmgm and first. I want all the combinations of these two numbers and two ...
5
votes
1answer
782 views

Forgot BitLock password- can I use dictionary attack?

I know that password has 10 possible words, but I don't know in which order. Can I write a simple bot and try to brute force the password that way? Is there some lockout time on BitLock?
4
votes
2answers
1k views

How Aircrack reliable is for decrypting password? other alternative?

I'm testing over a Handshake captured file I have (handshake.cap) launching aircrack attacks against it with a lot of dictionaries and bruteforce to decrypt its password, but I don't have a strong ...
0
votes
1answer
693 views

Crunch wordlist

I am trying to set up a wordlist of 8 character words where: the first letter is a capital 'WXCVBN' the next three are lower case 'wxcvbn' the next three are numbers between '123456' the last ...
1
vote
1answer
949 views

Using crunch, but using words like chars

I would like to generate a wordlist that contains words and 2 digit numbers. I want crunch to shuffle them like 15password15, password15, 15password... Is there any way I can do that with crunch or ...
3
votes
6answers
569 views

Is it safe to use HMAC with a public key for the purpose of salting?

I would like to store password hashes in a database. In order to prevent dictionary attacks, I was thinking to use HMAC with a key parameter which is public - like user id. That means the user id ...
1
vote
0answers
268 views

Password Strength: Compound Words [duplicate]

I’m familiar with XKCD’s Correct Horse Battery Stable example but I am wondering about one aspect of password strength. Dictionary words are an easy target for password crackers. If you compound a ...
0
votes
1answer
696 views

Generate a password dictionary from simple information [closed]

Suppose that we are going to perform a dictionary attack to crack the password of a known account. If we have some simple information from the account owner, such as first name, surname, age, date of ...
-1
votes
2answers
393 views

Limiting five letter string to only include words from dictionary in Crunch?

I am creating a word list for attacking a personal .dmg file on OS X. I'm using John the Ripper for the cracking, and Crunch to create the word list: ./crunch 13 13 abcdefghijklmnopqrstuvwxyz ...
-1
votes
2answers
170 views

Parse weak passwords based on dictionary file or app

I have a question similar to this one: How to create dictionary to prevent weak passwords? What I want to do though is simply check a list of passwords that exist in a text file I have that contains ...
3
votes
2answers
222 views

Can deliberately low-entropy hashes be used to prevent dictionary attacks?

Consider a system that receives, but does not store, a piece of sensitive information X from a user. If I wanted to add a way to remember when a user has submitted the same X more than once, what ...
0
votes
1answer
69 views

How do I resume a dictionary attack using a custom starting number?

The script below generates 8 digit strings using a combination of characters 0123456789 from number 00000000 to 99999999. crunch 8 8 0123456789 | aircrack-ng -a 2 'HOME-TC-FILE-CAP' -e 'ESSID' -b '...
-3
votes
1answer
140 views

need a help with creating a wordlist [duplicate]

i wanna create a 8 digit long password list containing simple & capital letters+all the numbers,but not with stupid passwords like all the 8 digits in numbers or simple or capital..should contain ...
2
votes
1answer
1k views

Passwordlist generation, permutations and long passwords

I was wondering what could be a way of generating a list where the passwords were like: CorrectHorseBatteryStaple BanjoTurtleNinjaHobo PizzaSurfMotherMetal etc... I already fiddled a little with ...
36
votes
7answers
8k views

Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?

Is it a bad idea to post a photo of your keyboard to social media? Can I look at a photo of a keyboard and determine the password of an account? Assuming a certain (set of) password(s) is the most ...
0
votes
2answers
925 views

How does a dictionary attack use it's “words”?

Does it assemble/concatenate the dictionary elements into candidate passwords, or does it just use the dictionary elements/words as passwords (which sounds strange)? I'm wondering about "SmartKey ZIP ...
1
vote
0answers
312 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...
1
vote
2answers
256 views

Are password-guessing attacks a real threat?

There are tons of questions, answers, articles, papers, cartoons etc. on the subject of how to choose a password in such a way that it's difficult to guess or crack with a dictionary-based attack. I ...
1
vote
1answer
266 views

Is it secure to allow an account to use `test123!` as their password?

I'm working on tightening up security for the auth layer of my app and I'm currently making a call on the complexity I'll require for passwords. Is there a 'standard' recommendation for complexity? ...
1
vote
2answers
2k views

Incremental charset with no duplicate adjacent letter [closed]

I'm using John the Ripper and the following charset in the creation of a word list: [Incremental:Upper8] File = $JOHN/upper.chr MinLen = 8 MaxLen = 8 CharCount = 36 The command: john –stdout –...
6
votes
5answers
568 views

Password guessing: Is it more effective to try many passwords against a few accounts or a few (very common) passwords against many accounts?

I was watching a security vid on Irongeek the other day (I immediately lost track of which specific vid, unfortunately) where the creator gave some interesting advice about doing live password ...
4
votes
2answers
1k views

I tried to break my WiFi: is 8 uppercase letter strong enough?

My Wi-Fi WPA-PSK password looked pretty weak: 8 uppercase letter. I have checked with another router from the same provider and the pattern is the same. To see how weak this is I tried to hack it ...
2
votes
4answers
211 views

What is the risk of different responses when a login username matches or not?

I am responsible for a website that allows a user to reset the password, as usual. However, the response of the website is different whether the entered username matches or not. This would allow an ...
2
votes
0answers
95 views

Password cracking based on properties of target [closed]

Many people base their passwords on some characteristics or properties of their persona, which might not even be included in wordlists used for a dictionary attack. If one would put research into ...
3
votes
3answers
3k views

Generate wordlist with exactly 4 letters and 6 numbers in any order?

I need to configure crunch so that it produces a wordlist with the following set of rules: Exactly 10 characters long Contains exactly 4 letters, which have to be a-f (all lowercase) Contains exactly ...