Generating Weak Passwords

by {"login"=>"averagesecurityguy", "email"=>"stephen@averagesecurityguy.info", "display_name"=>"averagesecurityguy", "first_name"=>"", "last_name"=>""}

I was watching Derbycon videos the other day and saw a great presentation by Chris Gates (@carnal0wnage) and Rob Fuller (@mubix) titled "The Dirty Little Secrets They Didn't Teach You in Pentesting Class." In the presentation they discuss a lot of tips and tricks pentesters can use to improve their pentests. One slide in particular caught my attention:

I couldn't help but think, it can't be that easy, but they are much more experienced than I am so I have to trust them. I decided to test this out on my next pentest, so I wrote a quick python script that will take a username or file of usernames and a company name or a file of company names and generate a new file of colon separated username and password combinations, which can be used in most password testing software. You can get the script here.

Using the script is easy, the command weak_passwords.py -u admin -c passco > user_pass_list will create a file called user_pass_list with the following username password combinations.

admin:password
admin:password123
admin:Password
admin:Password123
admin:p@ssw0rd
admin:p@ssw0rd123
admin:P@ssw0rd
admin:P@ssw0rd123
admin:p@ssword
admin:p@ssword123
admin:P@ssword
admin:P@ssword123
admin:passw0rd
admin:passw0rd123
admin:Passw0rd
admin:Passw0rd123
admin:welcome
admin:welcome123
admin:Welcome
admin:Welcome123
admin:welc0me
admin:welc0me123
admin:Welc0me
admin:Welc0me123
admin:changeme
admin:changeme123
admin:Changeme
admin:Changeme123
admin:passco
admin:passco123
admin:Passco
admin:Passco123
admin:admin
admin:admin123
admin:Admin
admin:Admin123

You can then use the list in any password auditing tool that takes a file of colon separated username password combinations, such as hydra, medusa, or metasploit.