TrustedSec - Weak in, Weak out: Keeping Password Lists Current

THIS POST WAS WRITTEN BY @NYXGEEK

When performing brute-force attacks, it’s our first instinct to go to the current season and year, i.e., Winter20, Winter2020. But it’s important to keep in mind that many organizations use a 90-day password change window, and 90 days can be a deceptively long time. For instance, as of today, February 25, 2020, the oldest passwords in such an organization would land in the end of November. It’s possible that a user has a November19 or Fall2019 password set.

To make the task of creating weak password lists a little easier, I’ve created weakpasswords.net (and south.weakpasswords.net for our friends in the Southern Hemisphere). This site displays a list of candidate passwords for brute-force attacks based on the current date and is updated daily via a cronjob.

The code is available on GitHub (https://github.com/nyxgeek/weakpass_generator) and is easily modified. Each month has an array of base words defined. For example, November has the following base words:

November
Fall
Autumn
Winter
Thanksgiving

There is another array defined that consists of popular suffixes. These include:

SHORTYEAR (e.g., 19)
LONGYEAR (e.g., 2019)
SHORTYEAR!
LONGYEAR!
1
123
@SHORTYEAR
@LONGYEAR

Again, this is easily modified to include your favorite endings. Happy hacking!

The post Weak in, Weak out: Keeping Password Lists Current appeared first on TrustedSec.



from TrustedSec https://www.trustedsec.com/blog/weak-in-weak-out-keeping-password-lists-current/

Comments

Post a Comment

Popular posts from this blog

Krebs - NY Charges First American Financial for Massive Data Leak

Image
In May 2019, KrebsOnSecurity broke the news that the website of mortgage title insurance giant First American Financial Corp. had exposed approximately 885 million records related to mortgage deals going back to 2003. On Wednesday, regulators in New York announced that First American was the target of their first ever cybersecurity enforcement action in connection with the incident, charges that could bring steep financial penalties. First American Financial Corp. Santa Ana, Calif.-based  First American [ NYSE:FAF ] is a leading provider of title insurance and settlement services to the real estate and mortgage industries. It employs some 18,000 people and brought in $6.2 billion in 2019 . As first reported here last year , First American’s website exposed 16 years worth of digitized mortgage title insurance records — including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images. The d...
Read more

KnowBe4 - Scam Of The Week: "When Users Add Their Names to a Wall of Shame"

Image
Eric Howes , KnowBe4 Principal Lab Researcher, found out about another insidious bad guy trick: " If you work in IT there has undoubtedly come a dark moment when you wondered to yourself just who among your employee users would be gullible enough to click through a phishing email and potentially bring down your organization. from KnowBe4 Security Awareness Training Blog https://blog.knowbe4.com/when-users-add-their-names-to-a-wall-of-shame
Read more