Busy in the password lab...

Deep in the heart of my secret laboratory here at Egis I conduct my experiment. A client asked that we test their web site login screens. Which method, I pondered? Brute force? Dictionary attack? While I harvested all of their likely usernames from social media and dark repositories, I decided on a combined approach. 

I want a dictionary attack that uses "words" but incorporates typical complexity requirements on networks. Why use just the word "password" when I can also try Password and P@ssword$1 and P@ssword#1 etc. against each of their usernames?

Searching my haunts, I find some lists - top 100, top 1000, top 10000, even the top million passwords in use. These lists are gathered by dark data librarians from the many millions of cracked passwords from big Internet hacks. Good old Yahoo, LinkedIn, and many other names we recognize. Tens of millions of passwords have been compromised and simple metrics ran to find the top X lists.

As I'm browsing through the top 10K list it's just as I thought. These are alright, but most of them couldn't be used by anyone required to meet common requirements. There it is... bosco... but no Bosco1 or Bosco$2... 

Maybe one of the employees at my client would take to bosco but make it more complex? Or any other common phase from this top 10,000 popular passwords list? 

Within fifteen minutes I've made a very small program and it generates my new attack dictionary. Now I've got the 10,000 original passwords to try plus 75,0000 more and this list is really nice. Kick off my attack program to test my client's web site login screen. Each of their likely usernames will be tested for any of these 85,000 passwords.

If their accounts are set up to lock after a few bad tries this could take a really long time. Might set up a delay between tries for each account of 30 minutes and let it run for a few weeks. If I get a hit on any accounts I'll need to see if there is 2-factor authentication that could stop me. May as well just let it fly fast for now, though.

Here's an article I stumbled across while searching for a pre-built list of common complex passwords. Read at your own risk, bwahahaha!  https://wpengine.com/unmasked/