Over the past years I have gathered a good amount of data and knowledge about how users get around password policies. I'm not going into detail on the Stratfor password policy, as it is already mentioned in the article linked above, but suffice to say, Stratfor like so many others, have a weak password policy, that makes hashing the passswords almost useless in terms of cracking.
Some wordlists are freely avaliable, such as the widely known JohnTheRipper wordlist or the one packaged with Cain and Able. The creators of JohnTheRipper even has a public listing of free wordlists, however, the wordlists are designed to give you access to passwords very quickly and thus, they are very small and not very 'complete'. Larger wordlists can be found scattered around the Internet, but they are generally of low quality and most of the time contains garbage that has no resemblance to passwords. There are some better quality wordlists out there, some are free, some are not, but when all is said and done, it is always better to create your own custom wordlists.
Being very eccentric in the field, I have created my own wordlist based on huge amounts of data from the Internet. My personal wordlist is a whopping 14.6 GB and is based on about 5000 smaller wordlists and other data sources. Without duplicates, a password length max of 25 and sorting it according to word frequency makes it very efficient when used in combination with a GPU. I will post more details later on how to create a good wordlist.
|Hashcat-Plus working on a wordlist|
Some cracking applications can apply rules to passwords, this is also sometimes referred to as word mangling. It is the process of taking a password and apply some sort of transformation to it. I've listed some of the common rules used with "password" as the example:
- Uppercase first char - result: Password
- Append 1 - result: password1
- Duplicate word - result: passwordpassword
- Prepend ! - result: !password
Brute forcing hashes is only effective when the password policy does not put a lower length constrain on the passwords and does not enforce the use of digits and symbols. The Stratfor password policy is one of many that has a weak policy, and thus, brute force can be used against the password hashes. Having a good strategy for what set of characters to use is essential to lower the time it takes to brute force hashes. I choose to go all out and crack all hashes from 1-8 characters in length in both uppercase, lowercase and digits. I also did a digits up to 12 in length and symbols only up to 10 in length. The total time spent on brute force is 3 days and 14 hours without optimizing hashcat to use the full potential of my graphics card.
The Stratfor leak contained 860,160 hashes and a total of 746,324 of them were cracked. That is a whopping 86.76% of the hashes!
Average password length: 7.907926
Contained in common wordlists
Top 30 most common passwords
Top 30 longest passwords
It struck me that almost all (86.76%) passwords were 8 characters long. A more uniform distribution is normally found in password databases.