06-07-2018, 04:12 PM
Another list that I like is from The Hacker Playbook. http://thehackerplaybook.com/get.php?type=THP-password
In addition to reading Hash Crack, The Hacker Playbook has some good password cracking tips.
In my opinion, there's nothing wrong with rockyou. I use it a lot and it usually gets me a lot of password with the type of work I do. Plus it's relatively small and fast. Great for low-hanging fruit. One thing we did was to take all the hashcat rules, remove duplicates, and put those in a single file and I run them with rockyou. I also use crackstation, but that takes a lot longer. That's something I'll run when I'm about done for the day and let it run overnight.
As Royce has said, the best password lists are ones that were actually human-generated passwords. You can also add in other things if you think they'll be helpful, like top names, cities, sports teams, etc. But actual password lists are better. You can generate your own too. Pastebin has password dumps every day. It's just a matter of finding them and scraping them before a pastebin admin deletes the paste. I'll often find those and grab the passwords and add those to my lists as well.
In addition to reading Hash Crack, The Hacker Playbook has some good password cracking tips.
In my opinion, there's nothing wrong with rockyou. I use it a lot and it usually gets me a lot of password with the type of work I do. Plus it's relatively small and fast. Great for low-hanging fruit. One thing we did was to take all the hashcat rules, remove duplicates, and put those in a single file and I run them with rockyou. I also use crackstation, but that takes a lot longer. That's something I'll run when I'm about done for the day and let it run overnight.
As Royce has said, the best password lists are ones that were actually human-generated passwords. You can also add in other things if you think they'll be helpful, like top names, cities, sports teams, etc. But actual password lists are better. You can generate your own too. Pastebin has password dumps every day. It's just a matter of finding them and scraping them before a pastebin admin deletes the paste. I'll often find those and grab the passwords and add those to my lists as well.