SecLists
zxcvbn
Our great sponsors
SecLists | zxcvbn | |
---|---|---|
177 | 59 | |
53,546 | 14,664 | |
- | 1.0% | |
9.6 | 0.0 | |
4 days ago | about 2 months ago | |
PHP | CoffeeScript | |
MIT License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
SecLists
-
Where can I find a large list of common usernames?
https://github.com/danielmiessler/SecLists/blob/master/Usernames/xato-net-10-million-usernames.txt is not enough usernames
-
DarkBeam leaks billions of email and password combinations
This reminds me of [0] where they maintain composite lists of frequently used passwords. Also in the repo is probably my favorite pull request ever [1].
[0] https://github.com/danielmiessler/SecLists
[1] https://github.com/danielmiessler/SecLists/pull/155
- Would you take this order?
-
What's the problem with my API?
Maybe swagger.txt
-
I had a machine running for two weeks on the public cloud. Every few seconds there was an automated SSH login attempt. Here is the full list of usernames - some of which are quite curious.
Typical of the sorts of information a tester/attacker might be using from: Daniel Miessler's SecLists
- How does one find a list of banned/breached passwords to add to our Azure Custom Password Block list?
-
[OC] I updated our famous password table for 2023
Oh, and then you have this.
-
Join Celebrations! Appwrite 1.3 Ships Relationships
You can now also enable a rule for password dictionary. Appwrite knows what are the most common passwords, and with this rule enabled, it will not allow you users to set any of those passwords. It prevents your users from having passwords like password, 123456678, or qwertyui. Appwrite currently knows the 10,000 most commonly used passwords thanks to the same list used by other industry-leading auth providers. You can check out the dictionary list on GitHub.
-
Help crack wpa2
Try wifite if you don’t know how to use hashcat it is pretty simple. Hashcat is pretty easy as well I am to lazy to get on my laptop right now but just get the right wordlist Seclist has a shit load of them https://github.com/danielmiessler/SecLists
-
Help me find the code
Fellow rust players know the way
zxcvbn
-
Show HN: A lightweight PHP library for checking password strength
Lightweight is an understatement here.
A client's project (with not necessarily technical customers) has had pretty reasonable success using the Dropbox originated library[1] for this, `zxcvbn`[2], on both frontend via js (for "instant" feedback) and on the backend via php (to enforce the requirements when writing password hashes to the database)
1: https://dropbox.tech/security/zxcvbn-realistic-password-stre...
2: https://github.com/dropbox/zxcvbn
- Zxcvbn: Low-Budget Password Strength Estimation – Usenix (2016)
-
I updated our famous password table for 2023
use zxcvbn to check your password strength more thoroughly
-
I hope the common password whitelisters at Microsoft still get therapy benefits to share the unobfuscated language they were subjected to.
source if anyone wants the whole list https://github.com/dropbox/zxcvbn/blob/master/data/passwords.txt
-
How long can a password be with the new login system?
Password strength is evaluated based on the zxcvbn library.
-
How hard could it be? Sorting words alphabetically in Rust
In contrast, let's consider the password "zxcvbn214". How might we assign an entropy to this password? Is it 369? Or 266 * 103? Anyone familiar with a QWERTY keyboard or Dropbox's password strength estimator knows that "zxcvbn" is hardly a random sequence of letters. This same principle applies to "l33t" speak, e.g. replacing all "e"s with 3s and "a"s with 4s. These strategies may "trick" simple entropy calculations into estimating a high entropy, but it won't trick sophisticated attackers. This leads to strength over-estimation, which is, I argue, the worst thing we can do in this context.
- Zxcvbn: Low-Budget Password Strength Estimation
-
TIL There's Another YAML
> except for ZXCVBN
You mean the Low-Budget Password Strength Estimator?
https://github.com/dropbox/zxcvbn
Yeah, that name is totally legit.
-
Which tool can crack this password so fast?
For any part of the password that the zxcvbn cannot match to a known pattern, it uses a brute-force cardinality of 10, i.e., it estimates that the number of guesses required to crack a password or password segment of length N is equal to 10N (equivalent to the number of guesses required to exhaust all possibilities if your password consisted only of numbers).
-
Bitwarden Design Flaw
We took a similar approach to passphrase stretching in EnvKey[1] v1 (EnvKey is a secrets manager, not a passwords manager, but uses end-to-end encryption in a similar way). We used PBKDF2 with iterations set a bit higher than the currently recommended levels, as well as Dropbox's zxcvbn lib to try to identify and block weak passphrases.
Ultimately, I think it's just not good enough. Even if you're updating iteration counts automatically (which is clearly not a safe assumption, and to be fair not something we did in EnvKey v1 either), and even with safeguards against weak passphrases, using human-generated passphrases as a single line of defense is just fundamentally weak.
That's why in EnvKey v2, we switched to primarily using high entropy device-based keys--a lot like SSH private keys, except that on Mac and Windows the keys get stored in the OS keychain rather than in the file system. Also like SSH, a passphrases can optionally be added on top.
The downside (or upside, depending how you look at it) is that new devices must be specifically granted access. You can't just log in and decrypt on a new device with only your passphrase. But the security is much stronger, and you also avoid all this song and dance around key stretching iterations.
1 - https://github.com/envkey/envkey
2 - https://github.com/dropbox/zxcvbn
What are some alternatives?
Probable-Wordlists - Version 2 is live! Wordlists sorted by probability originally created for password generation and testing - make sure your passwords aren't popular!
monkeytype - The most customizable typing website with a minimalistic design and a ton of features. Test yourself in various modes, track your progress and improve your speed.
gobuster - Directory/File, DNS and VHost busting tool written in Go
keepassxc - KeePassXC is a cross-platform community-driven port of the Windows application “Keepass Password Safe”.
wpscan - WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via [email protected]
dumb-password-rules - A compilation of sites with dumb password rules.
big-list-of-naughty-strings - The Big List of Naughty Strings is a list of strings which have a high probability of causing issues when used as user-input data.
Next.js - The React Framework
btcrecover - An open source Bitcoin wallet password and seed recovery tool designed for the case where you already know most of your password/seed, but need assistance in trying different possible combinations.
Material UI - Ready-to-use foundational React components, free forever. It includes Material UI, which implements Google's Material Design.
english-words - :memo: A text file containing 479k English words for all your dictionary/word-based projects e.g: auto-completion / autosuggestion
serve - Static file serving and directory listing