12-05-2020, 11:30 PM
First, if you have the luxury of validating your methodology against an identically-configured target but with a known plaintext, do so. (This isn't always possible, but definitely worth the trouble if basic attacks fail, so that you know that you're not "barking up the wrong tree")
Second, if you know that your methodology is good, running through the early part of a list like RockYou is good (because they are sorted by how common they are). But there's a long tail of RockYou at the other end that's less likely than other options. In other words: there are lots of common PINs and passwords that don't appear in RockYou.
Once you've working from that baseline, all you can really do is keep trying likely candidates.
Second, if you know that your methodology is good, running through the early part of a list like RockYou is good (because they are sorted by how common they are). But there's a long tail of RockYou at the other end that's less likely than other options. In other words: there are lots of common PINs and passwords that don't appear in RockYou.
Once you've working from that baseline, all you can really do is keep trying likely candidates.
~