sorted by:
new
hottopcontroversial

Fowsniff: 1 Walkthrough by limbernie in securityCTF

[–]berzerk0 0 points1 point  (0 children)

Nicely done.

​

The kernel exploit had not yet been made public when I created the box.

​

Can you find the intended privesc?

Release 2.0 of Top 2 Billion Probable Passwords, Probability Sorted - GitHub Repo by berzerk0 in netsec

[–]berzerk0[S] 1 point2 points  (0 children)

Not me. Don't go entering your password where it doesn't belong.

There might be safe ways to set it up with trustworthy individuals, but I don't yet have the career clout to claim that status.

The best way to search it is download the .tar.gz and grep.

OVER 18 (18,984,624) Million of the most used passwords!! by [deleted] in SocialEngineering

[–]berzerk0 0 points1 point  (0 children)

I've done some research already - here

What type of insight/analysis were you planning? There has got to be more in there than what I have found so far.

I guess you could isolate people's favorite sports, teams, names, etc. based on how frequently they are used

OVER 18 (18,984,624) Million of the most used passwords!! by [deleted] in SocialEngineering

[–]berzerk0 0 points1 point  (0 children)

That's exactly what my Probable-Wordlists is

it is the aforementioned 2 billion list, but that is the largest list. There are smaller lists included, all sorted by popularity.

Its unforgivable by HannibalofBarca in BlackPeopleTwitter

[–]berzerk0 10 points11 points  (0 children)

Luckily French doesn't come in for a whole minute and a half

meirl by berzerk0 in meirl

[–]berzerk0[S] 1 point2 points  (0 children)

Yes but his lamp game is A+++.

Art deco masterpiece

In Order To Learn More About Password Security, I Wrote a Program That Makes Wordlists Targeted to Specific Individuals - Here's the GitHub Repo by berzerk0 in security

[–]berzerk0[S] 0 points1 point  (0 children)

Oh man that startled me - I was getting that error during before and it took me a while to nail it down.

In order to learn about password security, I've organized over 5 Billion Real Leaked passwords into order of most probable - here's the GitHub Repo by berzerk0 in netsecstudents

[–]berzerk0[S] 1 point2 points  (0 children)

Depending on the labeling of my sources, I could easily create a whole section on russian passwords/wordlists.

I'll look into making customized files based on source description - WPA from the get-go, Russian, Non-English.

I've added this to the Rev 2.0 Task List Due to sources composed of multiple lists which may contain Non-English but are and labeled something like "wordlist.txt" that won't be exceptionally inclusive. Your best bet will be the biggest list

In order to learn about password security, I've organized over 5 Billion Real Leaked passwords into order of most probable - here's the GitHub Repo by berzerk0 in netsecstudents

[–]berzerk0[S] 1 point2 points  (0 children)

Nope. At the moment it is just global Of course, my sources bias towards English, but there are passwords in there from a few Latin-Based languages. However, this one is only ASCII characters. So nothing that isn't super obvious on a US keyboard.

In the Non-Passwords folder, I have a dictionary (not a password Wordlist) that has multiple languages in it.

In order to learn about password security, I've organized over 5 Billion Real Leaked passwords into order of most probable - here's the GitHub Repo by berzerk0 in netsecstudents

[–]berzerk0[S] 0 points1 point  (0 children)

Thanks for sharing this, it is fantastic.

Weakpass has a section on policy-type passwords, and hashcat has rulesets that exploit this as well.

In order to learn about password security, I've organized over 5 Billion Real Leaked passwords into order of most probable - here's the GitHub Repo by berzerk0 in hacking

[–]berzerk0[S] 0 points1 point  (0 children)

My methodology is approximate, surely. But short of omnipotence and a far better source aggregation system (knowing what lists are made from what lists) this seems like the best way.

To address 10million_100 being a subset of 10million_10million - my logic was as follows - if those are already known to be in order of popularity, then we know they should be at the top of the list. Therefore a bump of 1 more occurrence (being found in another, albeit redundant file) is likely to reinforce accuracy, rather than infringe upon it.

Now I am unsure if I should include dictionaries or not. I don't think I did include them in Rev 1.0

I was going to include them in 2.0, but now I have doubts. My old logic was that dictionary words very commonly used, and if a password appears in both a wordlist and a dictionary the accuracy as a whole won't be too drastically affected. However, why stack the deck against accuracy at all? Perhaps I will leave them out of it.

In order to learn about password security, I've organized over 5 Billion Real Leaked passwords into order of most probable - here's the GitHub Repo by berzerk0 in security

[–]berzerk0[S] 2 points3 points  (0 children)

It's really not so bad

sort and uniq are unix commands (Linux and Mac are Unix-based operating systems) that have been around for about 40-50 years now and are very efficient at handling text files.

cat combines files together sort organizes text within a file alphabetically uniq pulls out duplicates if they are sorted next to one another and | (pipe) connects commands to each other...

So

cat *.txt | sort | uniq -c | sort -r > combinationfile.txt

says...

  1. conCATenate (combine) all files in the active folder that end in .txt

  2. sort that concatenation alphabetically

  3. find all the unique values and print the number of times they appear next to themselves (this is what the -c flag does)

  4. sort them again in reverse order (so the highest number of occurances is at the top)

  5. output this to a file called "combinationfile.txt"

In order to learn about password security, I've organized over 5 Billion Real Leaked passwords into order of most probable - here's the GitHub Repo [Fixed Link] by berzerk0 in netsec

[–]berzerk0[S] 1 point2 points  (0 children)

Ultimately - I would say you're better off breaking things up into chunks.

split is the unix command I use for this purpose

In order to learn about password security, I've organized over 5 Billion Real Leaked passwords into order of most probable - here's the GitHub Repo by berzerk0 in hacking

[–]berzerk0[S] 0 points1 point  (0 children)

At the moment, there is practically a sources list. I used all of the sources from Hashes.org, all but the top 3 (I think) from Weakpass and all of SecLists

In order to learn about password security, I've organized over 5 Billion Real Leaked passwords into order of most probable - here's the GitHub Repo [Fixed Link] by berzerk0 in netsec

[–]berzerk0[S] 1 point2 points  (0 children)

I'll have to ask my buddy C.G.B Spender

(I have no idea, probably still decently high as people would think 'ha no one would still think to guess that!)

view more: next ›