Difference between revisions of "Passwords"
Line 159: | Line 159: | ||
<tr> | <tr> | ||
<td>[http://twitter.com/FSLabsAdvisor/status/12585285761 Facebook | <td>[http://twitter.com/FSLabsAdvisor/status/12585285761 Facebook (Pastebay)]</td> | ||
<td>[http://downloads.skullsecurity.org/passwords/facebook-pastebay.txt.bz2 facebook-pastebay.txt.bz2] (375 bytes)</td> | <td>[http://downloads.skullsecurity.org/passwords/facebook-pastebay.txt.bz2 facebook-pastebay.txt.bz2] (375 bytes)</td> | ||
<td>[http://downloads.skullsecurity.org/passwords/facebook-pastebay.txt facebook-pastebay.txt] (500 bytes)</td> | <td>[http://downloads.skullsecurity.org/passwords/facebook-pastebay.txt facebook-pastebay.txt] (500 bytes)</td> | ||
Line 165: | Line 165: | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>[http://twitter.com/FSLabsAdvisor/status/12585285761 Facebook | <td>[http://twitter.com/FSLabsAdvisor/status/12585285761 Facebook (Pastebay)] - w/ count</td> | ||
<td>[http://downloads.skullsecurity.org/passwords/facebook-pastebay-withcount.txt.bz2 facebook-pastebay-withcount.txt.bz2] (407 bytes)</td> | <td>[http://downloads.skullsecurity.org/passwords/facebook-pastebay-withcount.txt.bz2 facebook-pastebay-withcount.txt.bz2] (407 bytes)</td> | ||
<td>[http://downloads.skullsecurity.org/passwords/facebook-pastebay-withcount.txt facebook-pastebay-withcount.txt] (940 bytes)</td> | <td>[http://downloads.skullsecurity.org/passwords/facebook-pastebay-withcount.txt facebook-pastebay-withcount.txt] (940 bytes)</td> |
Revision as of 03:28, 22 April 2010
Password dictionaries
These are dictionaries that come with tools/worms/etc, designed for cracking passwords. As far as I know, I'm not breaking any licensing agreements by mirroring them with credit; if you don't want me to host one of these files, let me know and I'll remove it.
Name | Compressed | Uncompressed | Notes |
John the Ripper | john.txt.bz2 (10,934 bytes) | john.txt (21,935 bytes) | Simple, extremely good, designed to be modified |
Cain & Able | cain.txt.bz2 (1,069,968 bytes) | cain.txt (3,149,586 bytes) | Fairly comprehensive, not ordered |
Conficker worm | conficker.txt.bz2 (1411 bytes) | conficker.txt (702 bytes) | Used by conficker worm to spread -- low quality |
500 worst passwords | 500-worst-passwords.txt.bz2 (1868 bytes) | 500-worst-passwords.txt (3493 bytes) | |
370 Banned Twitter passwords | twitter-banned.txt.bz2 (1509 bytes) | twitter-banned.txt (2780 bytes) |
Leaked passwords
Passwords that were leaked or stolen from sites. I'm hosting them because it seems like nobody else does (hopefully it isn't because hosting them is illegal :)). Naturally, I'm not the one who stole these; I simply found them online, removed any names/email addresses/etc (I don't see any reason to supply usernames -- if you do have a good reason, email me (ron-at-skullsecurity.net) and I'll see if I have them.
The best use of these is to generate or test password lists.
Name | Compressed | Uncompressed | Notes |
Rockyou | rockyou.txt.bz2 (60,498,886 bytes) | rockyou.txt (139,921,497 bytes) | Best list available; huge, stolen unencrypted |
Rockyou with count | rockyou-withcount.txt.bz2 (59,500,255 bytes) | rockyou-withcount.txt (254,676,625 bytes) | |
phpbb | phpbb.txt.bz2 (868,606 bytes) | phpbb.txt (1,574,395 bytes) | Ordered by commonness Cracked from md5 by Brandon Enright (97%+ coverage) |
phpbb with count | phpbb-withcount.txt.bz2 (872,867 bytes) | phpbb-withcount.txt (3,049,507 bytes) | |
phpbb with md5 | phpbb-withmd5.txt.bz2 (4,117,887 bytes) | phpbb-withmd5.txt (7,659,241 bytes) | |
MySpace | myspace.txt.bz2 (175,970 bytes) | myspace.txt (356,352 bytes) | Captured via phishing |
MySpace - with count | myspace-withcount.txt.bz2 (179,929 bytes) | myspace-withcount.txt (653,504 bytes) | |
Hotmail | hotmail.txt.bz2 (47,195 bytes) | hotmail.txt (87,383 bytes) | Isn't clearly understood how these were stolen |
Hotmail with count | hotmail-withcount.txt.bz2 (47,975 bytes) | hotmail-withcount.txt (158,831 bytes) | |
Faithwriters | faithwriters.txt.bz2 (39,327 bytes) | faithwriters.txt (72,695 bytes) | Religious passwords |
Faithwriters - with count | faithwriters-withcount.txt.bz2 (40,233 bytes) | faithwriters-withcount.txt (139,480 bytes) | |
Elitehacker | elitehacker.txt.bz2 (3,690 bytes) | elitehacker.txt (6,516 bytes) | Part of zf05.txt |
Elitehacker - with count | elitehacker-withcount.txt.bz2 (3,846 bytes) | elitehacker-withcount.txt (13,676 bytes) | |
Hak5 | hak5.txt.bz2 (16,490 bytes) | hak5.txt (24,714 bytes) | Part of zf05.txt |
Hak5 - with count | hak5-withcount.txt.bz2 (16,947 bytes) | hak5-withcount.txt (43,522 bytes) | |
Alysaa | alysaa.txt.bz2 (5,178 bytes) | alysaa.txt (11,634 bytes) | Finnish passwords |
Alysaa - with count | alysaa-withcount.txt.bz2 (6,013 bytes) | alysaa-withcount.txt (22,706 bytes) | |
Facebook (Pastebay) | facebook-pastebay.txt.bz2 (375 bytes) | facebook-pastebay.txt (500 bytes) | Found on Pastebay; appear to be malware-stolen. |
Facebook (Pastebay) - w/ count | facebook-pastebay-withcount.txt.bz2 (407 bytes) | facebook-pastebay-withcount.txt (940 bytes) |
Coverage (Rockyou)
I did some calculations and determined how many passwords you'd need, on average, to crack which percentage of users' passwords, based on the leaked passwords from Rockyou.com. These lists will crack the advertised amount on an average cross-section of people if no password restrictions are in place:
Passwords | Coverage | Download |
13 | 4.99% | rockyou-5.txt (104 bytes) |
92 | 10.00% | rockyou-10.txt (723 bytes) |
249 | 15.01% | rockyou-15.txt (1,943 bytes) |
512 | 20.00% | rockyou-20.txt (3,998 bytes) |
929 | 25.00% | rockyou-25.txt (7,229 bytes) |
1556 | 30.00% | rockyou-30.txt (12,160 bytes) |
2506 | 35.00% | rockyou-35.txt (19,648 bytes) |
3957 | 40.00% | rockyou-40.txt (31,220 bytes) |
6164 | 45.00% | rockyou-45.txt (49,133 bytes) |
9438 | 50.00% | rockyou-50.txt (75,912 bytes) |
14236 | 55.00% | rockyou-55.txt (115,186 bytes) |
21041 | 60.00% | rockyou-60.txt (170,244 bytes) |
30290 | 65.00% | rockyou-65.txt (244,535 bytes) |
42661 | 70.00% | rockyou-70.txt (344,231 bytes) |
59187 | 75.00% | rockyou-75.txt (478,948 bytes) |
Statistics
I did some tests of my various dictionaries against the different sets of leaked passwords. I grouped them by the password set they were trying to crack:
- cracked_500worst.png
- cracked_elitehackers.png
- cracked_faithwriters.png
- cracked_hak5.png
- cracked_hotmail.png
- cracked_myspace.png
- cracked_phpbb.png
- cracked_rockyou.png
Miscellaneous non-hacking dictionaries
These are dictionaries of words (etc), not passwords. They may be useful for one reason or another.
Name | Compressed | Uncompressed | Notes |
English | english.txt.bz2 (1,063,071 bytes) | english.txt (3,144,506 bytes) | My combination of a couple lists, one from Andrew Orr |
German | german.txt.bz2 (2,121,045 bytes) | german.txt (6,736,833 bytes) | See header for credit info |
American cities | us_cities.txt.bz2 (77,081 bytes) | us_cities.txt (207,041 bytes) | Generated by RSnake |
"Porno" | porno.txt.bz2 (7,158,285 bytes) | porno.txt (46,955,376 bytes) | World's largest porno password collection! |