Presented at
BSidesDC 2017,
Oct. 7, 2017, 2:30 p.m.
(50 minutes).
Popular wordlists such as Rockyou and Uniq are great when used with a variety of rules and big hash sets. But what about the hashes that you aren't able to crack? And what about those users with a base word not found in a standard dictionary?
Queue Wordsmith, a tool that creates wordlists that are tailored to the target’s location. We’ve parsed and analyzed several geographic databases to find road names, cities, counties, landmarks, sports teams, and more for regions all around the world. Built using a modular framework and hosted on GitHub, Wordsmith’s database can easily be updated by anyone with a text editor and an interest in geolocation or spatial databases. With data from 249 countries and territories, Wordsmith can bolster typical dictionaries by adding the name of that unique street that a person grew up on, or by appending a region’s postal codes, all so you crack those hard-to-get hashes.
Presenters:
-
Tom Porter
- Sr. Penetration Tester at PSC/NCC Group
Tom (@porterhau5) is a penetration tester by trade, however his roots are on the blue team writing netflow analytics and providing network situational awareness. Tom holds a handful of certifications from SANS, as well as degrees in Mathematics and CS. When there's not a baseball game nearby, he can be found scripting, participating in CTFs, dissecting packets, tinkering in his homelab, performing password analysis, or chasing high IBUs.
-
Sanjiv Kawa
- Sr. Penetration Tester at PSC/NCC Group
I enjoy searching for creative ways to break into restricted networks and applications. I also like to write tools that automate things or make a life a little easier. Something I’m trying to get better at is binary analysis and exploit development. When my laptop battery dies you can find me at breweries, on the ski hill or playing soccer.
Links:
Similar Presentations: