darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-05 01:08:25 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
3182fc7668dca795586d5acd5634ab31dc71eb90
notifications-admin/app/main/_commonly_used_passwords.py

6977 lines
114 KiB
Python
Raw Normal View History

Remove term ‘blacklist’ from codebase ‘Commonly used passwords’ is more specific, and avoids the terminology ‘blacklist’ which the National Cyber Security Centre explain to be problematic: > It's fairly common to say whitelisting and blacklisting to describe desirable and undesirable things in cyber security. For instance, when talking about which applications you will allow or deny on your corporate network; or deciding which bad passwords you want your users not to be able to use. > > However, there's an issue with the terminology. It only makes sense if you equate white with 'good, permitted, safe' and black with 'bad, dangerous, forbidden'. There are some obvious problems with this. So in the name of helping to stamp out racism in cyber security, we will > avoid this casually pejorative wording on our website in the future. No, it's not the biggest issue in the world - but to borrow a slogan from elsewhere: every little helps. – https://www.ncsc.gov.uk/blog-post/terminology-its-not-black-and-white
2020-06-16 18:04:29 +01:00
commonly_used_passwords = [
Add variations on GOV.UK Notify to blacklist There’s a chance that someone will run out of imagination and use the name of the thing they’re signing up for as their password. This wouldn’t be caught by the generic blacklist.
2016-09-27 12:24:46 +01:00
'govuknotify',
'GOVUKnotify',
'GOV.UK Notify',
'GOV.UK notify',
'gov.uk notify'
] + [
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'11111111',
'12345678',
'123456789',
'access14',
'alejandra',
'alejandro',
'baseball',
'bigdaddy',
'butthead',
'cocacola',
'computer',
'consumer',
'corvette',
'danielle',
'dolphins',
'einstein',
'estrella',
'firebird',
'football',
'hardcore',
'iloveyou',
'internet',
'jennifer',
'mariposa',
'marlboro',
'maverick',
'mercedes',
'michelle',
'midnight',
'mistress',
'mountain',
'nicholas',
'password',
'password1',
'password12',
'password123',
'princess',
'qwertyui',
'redskins',
'redwings',
'rush2112',
'samantha',
'scorpion',
'sebastian',
'srinivas',
'startrek',
'starwars',
'steelers',
'sunshine',
'superman',
'swimming',
'tequiero',
'trustno1',
'victoria',
'whatever',
'xxxxxxxx',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'1234567890',
'1q2w3e4r5t',
'qwertyuiop',
'myspace1',
'1qaz2wsx',
'target123',
'1g2w3e4r',
'gwerty123',
'zag12wsx',
'1q2w3e4r',
'987654321',
'qwerty123',
'asdfghjkl',
'123123123',
'iloveyou1',
'fuckyou1',
'789456123',
'princess1',
'linkedin',
'1234qwer',
'j38ifUbn',
'football1',
'123456789a',
'abcd1234',
'jordan23',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'88888888',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'12qwaszx',
'FQRG7CS493',
'blink182',
'michael1',
'babygirl1',
'0123456789',
'iloveyou2',
'147258369',
'q1w2e3r4',
'jessica1',
'qwer1234',
'liverpool',
'fuckyou2',
'1111111111',
'qazwsxedc',
'baseball1',
'0987654321',
'anthony1',
'00000000',
'29rsavoy',
'basketball',
'qwerty12',
'charlie1',
'passw0rd',
'asshole1',
'superman1',
'sunshine1',
'babygirl',
'asdf1234',
'chocolate',
'password2',
'12341234',
'12344321',
'q1w2e3r4t5y6',
'qweasdzxc',
'a123456789',
'VQsaBLPzLa',
'hello123',
'butterfly',
'1qazxsw2',
'cjmasterinf',
'brandon1',
'1234567891',
'alexander',
'PE#5GZ29PTZMSE',
'dpbk1234',
'DIOSESFIEL',
'pakistan',
'123654789',
'matthew1',
'3rJs1la7qE',
'пїЅпїЅпїЅпїЅпїЅпїЅ',
'barcelona',
'computer1',
'michelle1',
'12345678910',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'jonathan',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'liverpool1',
'11223344',
'12345qwert',
'111222tianya',
'william1',
'chicken1',
'0000000000',
'jasmine1',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'benjamin',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'welcome1',
'christian',
'1234554321',
'chocolate1',
'butterfly1',
'q1w2e3r4t5',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'slipknot',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'zaq12wsx',
'147852369',
'elizabeth',
'87654321',
'1password',
'america1',
'metallica',
'chelsea1',
'1234567a',
'iw14Fi9j',
'juventus',
'jennifer1',
'999999999',
'elizabeth1',
'123qweasd',
'tinkerbell',
'samantha1',
'Sojdlg123aljg',
'myspace123',
'freedom1',
'whatever1',
'valentina',
'741852963',
'spongebob1',
'1234abcd',
'hellokitty',
'madison1',
'spiderman',
'diamond1',
'pokemon1',
'mustang1',
'1qaz2wsx3edc',
'justinbieb',
'friends1',
'asdfasdf',
'qwerty12345',
'123hfjdk147',
'iloveyou!',
'fuckoff1',
'bubbles1',
'a1b2c3d4',
'123456789q',
'heather1',
'4815162342',
'yankees1',
'asdfghjkl1',
'1q2w3e4r5t6y',
'patrick1',
'12121212',
'alexander1',
'raiders1',
'Password1',
'zxcvbnm1',
'melissa1',
'slipknot1',
'spiderman1',
'cowboys1',
'a1234567',
'november',
'alexandra',
'veronica',
'cristina',
'newyork1',
'jackson1',
'iloveyou12',
'PolniyPizdec0211',
'password!',
'a838hfiD',
'richard1',
'beautiful1',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'carolina',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'patricia',
'stephanie',
'421uiopy258',
'myspace2',
'monster1',
'elephant',
'963852741',
'destiny1',
'123456abc',
'december',
'9876543210',
'manchester',
'12345678a',
'пїЅпїЅпїЅпїЅпїЅпїЅпїЅ',
'kristina',
'lovelove',
'gangsta1',
'charlotte',
'scooter1',
'caroline',
'super123',
'marseille',
'metallica1',
'beautiful',
'danielle1',
'blessed1',
'1029384756',
'qazwsx123',
'california',
'christian1',
'arsenal1',
'babyboy1',
'1122334455',
'aa123456',
'forever1',
'Password',
'1a2b3c4d',
'playboy1',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'creative',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'пїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅ',
'brittany1',
'letmein1',
'cameron1',
'spongebob',
'uQA9Ebw445',
'fernando',
'startfinding',
'softball',
'dolphin1',
'qwerty1234',
'september',
'isabella',
'abc123456',
'password3',
'abcdefg123',
'loveyou1',
'leonardo',
'password.',
'samsung1',
'qwert123',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'poohbear',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'garfield',
'YAgjecc826',
'qwerty123456',
'iloveme1',
'nicholas1',
'portugal',
'precious',
'jackass1',
'jonathan1',
'rainbow1',
'angel123',
'fuckyou!',
'starwars1',
'tiffany1',
'poohbear1',
'1234512345',
'qq123456',
'abcdefg1',
'crystal1',
'azertyuiop',
'angelina',
'svetlana',
'icecream',
'popcorn1',
'victoria1',
'twilight',
'brittany',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'snickers',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'aaaaaaaa',
'swordfish',
'fyfcnfcbz',
'rockstar1',
'yourmom1',
'christine',
'steelers1',
'shannon1',
'peaches1',
'florida1',
'stephanie1',
'lollipop',
'greenday1',
'iverson3',
'motorola',
'rockstar',
'lakers24',
'southside1',
'bismillah',
'pa55word',
'emmanuel',
'5555555555',
'password11',
'love4ever',
'greenday',
'isabelle',
'babygurl1',
'santiago',
'chester1',
'kimberly',
'happy123',
'55555555',
'satan666',
'francesco',
'vanessa1',
'a12345678',
'realmadrid',
'1123581321',
'soccer12',
'fktrcfylh',
'qwert12345',
'1v7Upjw3nT',
'p@ssw0rd',
'thunder1',
'zxcvbnm123',
'midnight1',
'lebron23',
'strawberry',
'love1234',
'soccer10',
'darkness',
'qw123321',
'22222222',
'd41d8cd98f00b204e9800998ecf8427e',
'charles1',
'logitech',
'princess12',
'precious1',
'brooklyn1',
'snowball',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'courtney',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'123qwe123',
'brooklyn',
'vladimir',
'111222333',
'asdfghjk',
'lizottes',
'123454321',
'123qweasdzxc',
'superstar',
'rebecca1',
'catherine',
'123698745',
'vkontakte',
'getmoney1',
'hollister1',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'remember',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'abc12345',
'111111111',
'cjkysirj',
'money123',
'element1',
'P3Rat54797',
'francesca',
'undertaker',
'asdfjkl;',
'facebook',
'chouchou',
'password7',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'kawasaki',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'linkinpark',
'ronaldo7',
'asdasdasd',
'alessandro',
'courtney1',
'qqww1122',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'scarface',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'angelica',
'australia',
'qti7Zxh18U',
'пїЅпїЅпїЅпїЅпїЅ',
'chicago1',
'softball1',
'natalie1',
'monkey123',
'bullshit',
'sunflower',
'21212121',
'volleyball',
'пїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅ',
'sweetpea',
'zxcvbnm:',
'bitch123',
'babygirl12',
'goodluck',
'gateway1',
'bigdaddy1',
'31415926',
'christina',
'aleksandr',
'gabriel1',
'ihateyou',
'antonio1',
'awesome1',
'fishing1',
'amoremio',
'monkey12',
'brianna1',
'bitches1',
'princesa',
'asdfghjkl;',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'changeme',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'passwort',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'valentin',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'12345qwerty',
'paradise',
'scarface1',
'jesus123',
'sweetheart',
'qwertyuiop[]',
'fuckyou123',
'P@ssw0rd',
'myspace!',
'williams',
'gabriela',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'77777777',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'christopher',
'soccer11',
'westside',
'giovanni',
'apple123',
'zachary1',
'christophe',
'123456aa',
'pumpkin1',
'nirvana1',
'hotmail1',
'cookies1',
'shopping',
'password5',
'superstar1',
'maryjane',
'benjamin1',
'margarita',
'cristian',
'qwerasdf',
'motdepasse',
'147896325',
'25802580',
'westside1',
'iloveyou.',
'123456789m',
'grandma1',
'dbrnjhbz',
'dearbook',
'chris123',
'ladybug1',
'loveyou2',
'giuseppe',
'football12',
'sabrina1',
'september1',
'icecream1',
'loverboy',
'sterling',
'йцукен',
'christina1',
'virginia',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'savannah',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'inuyasha1',
'hallo123',
'twilight1',
'snickers1',
'friendster',
'adgjmptw',
'123456654321',
'champion',
'bestfriend',
'rhbcnbyf',
'internet1',
'teddybear',
'blessing',
'abcdefgh',
'happiness',
'password01',
'frankie1',
'Tnk0Mk16VX',
'aaaaaaaaaa',
'flowers1',
'cupcake1',
'johncena1',
'123456qwerty',
'192837465',
'PASSWORD',
'rangers1',
'bulldog1',
'simpsons',
'blahblah',
'carpediem',
'francisco',
'19871987',
'veronika',
'пароль',
'airforce1',
'inuyasha',
'casanova',
'123456789z',
'chocolat',
'jackson5',
'W5tXn36alfW',
'nintendo',
'321654987',
'19851985',
'hollywood',
'runescape1',
'pass1234',
'spencer1',
'cheyenne',
'99999999',
'panasonic',
'12369874',
'ciaociao',
'florence',
'123321123',
'phoenix1',
'anderson',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'warcraft',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'poiuytrewq',
'myspace12',
'colorado',
'Passw0rd',
'gangster1',
'mamapapa',
'sweetie1',
'business',
'maradona',
'rammstein',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'microsoft',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'kimberly1',
'ihateyou1',
'soccer13',
'babygirl2',
'hollywood1',
'anastasia',
'jesus777',
'redneck1',
'zzzzzzzz',
'lasvegas',
'stonecold',
'maxwell1',
'princess2',
'19861986',
'sureno13',
'savannah1',
'engineer',
'paintball1',
'19841984',
'135792468',
'amsterdam',
'skittles',
'forever21',
'14789632',
'19921992',
'orlando1',
'children',
'christmas',
'asdasd123',
'cocacola1',
'snowball1',
'123456123',
'sebastian1',
'drowssap',
'soccer123',
'kingkong',
'123456123456',
'gangster',
'7894561230',
'shithead1',
'patches1',
'trouble1',
'mercedes1',
'MaprCheM56458',
'digital1',
'maryjane1',
'stephen1',
'kathleen',
'marshall',
'hahahaha',
'zaq1xsw2',
'minecraft',
'argentina',
'serenity',
'password4',
'a1s2d3f4',
'alexandre',
'barcelona1',
'123789456',
'password00',
'georgia1',
'porsche1',
'1qaz1qaz',
'megaparol12345',
'iG4abOX4',
'dragonball',
'football2',
'nathalie',
'trinity1',
'colombia',
'killer123',
'bullshit1',
'terminator',
'69696969',
'onelove1',
'password13',
'baseball12',
'nothing1',
'myspace.',
'harrypotter',
'security',
'elephant1',
'teddybear1',
'winston1',
'summer08',
'sexybitch1',
'welcome123',
'katherine',
'scotland',
'dinosaur',
'iloveyou3',
'fuckyou69',
'19891989',
'admin123',
'federico',
'success1',
'cutiepie1',
'green123',
'trfnthbyf',
'12301230',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'margaret',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'godisgood',
'charlotte1',
'11112222',
'19821982',
'david123',
'beatrice',
'hardcore1',
'franklin',
'123456789s',
'любовь',
'penelope',
'mitchell',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'66666666',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'hercules',
'katerina',
'allison1',
'charmed1',
'babydoll',
'christine1',
'123456987',
'india123',
'monique1',
'19801980',
'1loveyou',
'20102010',
'blackberry',
'19951995',
'alejandro1',
'iloveme2',
'1234asdf',
'music123',
'9-11-1961',
'skittles1',
'cdtnkfyf',
'tokiohotel',
'1234567q',
'ka_dJKHJsy6',
'qazwsx12',
'idontknow',
'truelove',
'houston1',
'shithead',
'wolverine',
'bradley1',
'mahalkita',
'sexygirl1',
'timothy1',
'19831983',
'yahoo.com',
'platinum',
'isabella1',
'password10',
'valentine',
'vampires',
'password0',
'strength',
'asd123456',
'10101010',
'baseball2',
'11235813',
'chopper1',
'g9l2d1fzPY',
'jamesbond',
'goldfish',
'carolina1',
'vincent1',
'summer09',
'packers1',
'martinez',
'cutiepie',
'D1lakiss',
'qazxswedc',
'diamonds',
'ferrari1',
'napoleon',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'13131313',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'panther1',
'zxcv1234',
'lacrosse',
'federica',
'123456789j',
'passport',
'buddy123',
'omsairam',
'bulldogs',
'ilovehim1',
'james123',
'cleopatra',
'1qa2ws3ed',
'Linkedin',
'catalina',
'wrestling1',
'Megaparol12345',
'fernanda',
'myspace3',
'harrison',
'blondie1',
'buttercup',
'muhammad',
'medicine',
'fuckme69',
'SZ9kQcCTwY',
'gordon24',
'19881988',
'stellina',
'1234567899',
'pa55w0rd',
'skateboard',
'pebbles1',
'stargate',
'natasha1',
'drummer1',
'abigail1',
'raymond1',
'thuglife',
'johnson1',
'pokemon123',
'remember1',
'sporting',
'salvatore',
'blablabla',
'handsome',
'johncena',
'14531453',
'penguin1',
'budlight1',
'infinity',
'naruto123',
'montana1',
'10203040',
'scoobydoo',
'jesuschrist',
'devil666',
'44444444',
'thebest1',
'1myspace',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'kittycat',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'pineapple',
'qwerty11',
'veronica1',
'PolniyPizdec110211',
'england1',
'mypassword',
'smoke420',
'wordpass',
'asdfasdf1',
'aaliyah1',
'genesis1',
'lilwayne1',
'spartan117',
'kkkkkkkk',
'password9',
'alexandra1',
'sk84life',
'salvador',
'newport1',
'daniel123',
'привет',
'darkness1',
'ilovejesus',
'summer07',
'melanie1',
'lawrence',
'alabama1',
'monkeys1',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'peterpan',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'dumbass1',
'ekaterina',
'2012comeer',
'lollipop1',
'cricket1',
'blahblah1',
'papillon',
'12131415',
'michigan',
'19941994',
'panthers',
'idontknow1',
'369258147',
'iloveyou7',
'mexican1',
'runescape',
'fordf150',
'ilovegod',
'spitfire',
'godzilla',
'33333333',
'azerty123',
'19931993',
'wildcats',
'test1234',
'mohammed',
'ladygaga',
'qweasd123',
'1princess',
'dragons1',
'bluefish',
'dolphins1',
'qwerty321',
'miranda1',
'cassandra',
'password22',
'something',
'qwe12345',
'dragon123',
'pitbull1',
'moonlight',
'password69',
'nonmember',
'5532361cnjqrf',
'19811981',
'tiger123',
'panthers1',
'jeffrey1',
'dodgers1',
'dickhead1',
'dragon12',
'guinness',
'123456asd',
'buttercup1',
'vampire1',
'loser123',
'dIWtgm8492',
'bulldogs1',
'123456789l',
'19901990',
'cheyenne1',
'friendship',
'cambiami',
'linkedin1',
'abcde12345',
'jamaica1',
'lindsey1',
'пїЅпїЅпїЅпїЅ',
'teacher1',
'zxcvbnm,./',
'yousuck1',
'myspace.co',
'babydoll1',
'987456321',
'bluebird',
'casablanca',
'password8',
'death666',
'watermelon',
'asdqwe123',
'predator',
'soccer14',
'19911991',
'123qwerty',
'candy123',
'babygurl',
'lucky123',
'loverboy1',
'lovelife',
'special1',
'3rJs5la8qE',
'3rJs1la2qE',
'sweetpea1',
'insanity',
'123456789d',
'ronaldinho',
'birthday',
'pussycat',
'123456qwe',
'fountain',
'christmas1',
'123456789k',
'sexygirl',
'viktoria',
'kristen1',
'shadow12',
'20092009',
'kenneth1',
'illinois',
'formula1',
'antonella',
'1357924680',
'yankees2',
'jaimatadi',
'sk8ordie',
'1234567890q',
'justice1',
'fuckyou12',
'kitty123',
'broncos1',
'qweqweqwe',
'paramore',
'atlanta1',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'assassin',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'alessandra',
'creative1',
'люблю',
'naruto12',
'drpepper',
'valencia',
'19781978',
'nks230kjs82',
'lover123',
'lovebug1',
'killer12',
'01020304',
'bella123',
'sunflower1',
'boobies1',
'defender',
'youngmoney',
'anhyeuem',
'пїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅ',
'barbara1',
'qazwsxedcrfv',
'lilmama1',
'9999999999',
'alejandra1',
'123456789p',
'redskins1',
'darkangel',
'liberty1',
'newlife1',
'sammy123',
'monalisa',
'butterfly2',
'prettygirl',
'getmoney',
'temppass',
'drpepper1',
'schalke04',
'pantera1',
'october1',
'sexymama1',
'a1b2c3d4e5',
'agent007',
'bubblegum1',
'qazwsxedc1',
'swordfish1',
'scorpio1',
'dickhead',
'patricia1',
'catherine1',
'dominic1',
'marissa1',
'cherokee',
'mommy123',
'molly123',
'katherine1',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'lorraine',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'explorer',
'cooldude',
'myspace7',
'porsche911',
'colombia1',
'12345679',
'CM6E7Aumn9',
'19791979',
'2222222222',
'bearshare',
'qawsedrf',
'indonesia',
'monkey11',
'justdoit',
'marines1',
'vikings1',
'aquarius',
'valentino',
'cookie123',
'baseball7',
'20082008',
'september2',
'kittycat1',
'kissmyass',
'Groupd2013',
'as123456',
'pickles1',
'michigan1',
'shadow123',
'chargers1',
'babyblue',
'skyline1',
'scoobydoo1',
'november1',
'wrestling',
'warrior1',
'superman12',
'pakistan1',
'ronaldo9',
'december1',
'dalejr88',
'geronimo',
'akopa123',
'bollocks',
'dominique',
'football10',
'perfect1',
'thuglife1',
'ghbdtnbr',
'dragonfly',
'bigdick1',
'sapphire',
'000000000',
'michael2',
'jeremiah',
'hotstuff1',
'19961996',
'icehouse',
'lindsay1',
'19751975',
'istanbul',
'OcPOOok325',
'thailand',
'personal',
'passion1',
'password23',
'hershey1',
'capricorn',
'fucklove1',
'babylove',
'vaffanculo',
'stanley1',
'marketing',
'123456789o',
'sandrine',
'qwerqwer',
'something1',
'charlene',
'baseball3',
'angelito',
'football7',
'american',
'aspirine',
'maverick1',
'claudia1',
'brother1',
'tottenham',
'westlife',
'7777777777',
'pokemon12',
'bobmarley',
'vacation',
'hotstuff',
'asdfghjkl:',
'1q2w3e4r5t6y7u8i9o0p',
'password6',
'stefania',
'nicole12',
'spiderman3',
'caroline1',
'gregory1',
'smile123',
'daddysgirl',
'1asshole',
'lollypop',
'lilwayne',
'cashmoney1',
'qqqqqqqq',
'ireland1',
'princess10',
'skate4life',
'scarlett',
'asdfjkl:',
'patriots1',
'josephine',
'callofduty',
'princesse',
'nightmare',
'germany1',
'soccer15',
'magnolia',
'longhorns1',
'tristan1',
'micheal1',
'testpass',
'112233445566',
'snowman1',
'douglas1',
'esperanza',
'enterprise',
'maria123',
'master123',
'warcraft1',
'qwe123456',
'asdfg123',
'williams1',
'cinderella',
'marshall1',
'baseball11',
'vincenzo',
'pavilion',
'cheater1',
'shamrock',
'purple12',
'australia1',
'sebastien',
'jellybean',
'google123',
'ironmaiden',
'3Odi15ngxB',
'country1',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'eternity',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'98765432',
'simpsons1',
'cracker1',
'gabrielle',
'Welcome1',
'superman2',
'shopping1',
'bettyboop1',
'ricardo1',
'marlboro1',
'juggalo1',
'therock1',
'monkey13',
'garfield1',
'arizona1',
'fashion1',
'rolltide',
'1234567890a',
'iloveyou22',
'daniel12',
'testtest',
'slayer666',
'baseball10',
'393041123',
'jordan12',
'12qw23we',
'washington',
'rfnthbyf',
'bananas1',
'123456789987654321',
'наташа',
'brownie1',
'everton1',
'ashley12',
'123456789123',
'987654321a',
'wangyut2',
'butthead1',
'newcastle',
'magdalena',
'rosebud1',
'ashley123',
'billabong',
'boricua1',
'●●●●&#96',
'underground',
'12345abc',
'iloveyou11',
'chandler',
'qwe1122334',
'andromeda',
'punkrock',
'just4fun',
'hamilton',
'iloveyou13',
'fuckyou.',
'whitney1',
'hernandez',
'juliette',
'19761976',
'dreamer1',
'pk3x7w9W',
'golfcourse',
'pineapple1',
'godislove',
'madeline',
'my2girls',
'babycakes1',
'yuantuo2012',
'marianne',
'cutie123',
'wildcats1',
'loveme123',
'fireball',
'montreal',
'1babygirl',
'12345qwe',
'hottie101',
'3d8Cubaj2E',
'serenity1',
'billabong1',
'1q2w3e4r5',
'PolniyPizdec1102',
'karolina',
'thumper1',
'e10adc3949ba59abbe56e057f20f883e',
'19971997',
'zxasqw12',
'baseball5',
'champion1',
'black123',
'aobo2010',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'rosemary',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'scrappy1',
'rocky123',
'highheel',
'eastside1',
'monkey22',
'qwe123qwe',
'cynthia1',
'asdf3423',
'sublime1',
'fernando1',
'19771977',
'myspace11',
'jellybean1',
'preston1',
'soccer22',
'maximus1',
'beatles1',
'hongkong',
'windows1',
'максим',
'nicole123',
'marianna',
'patriots',
'19731973',
'jesucristo',
'lovelove1',
'babygirl13',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'apollo13',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'iloveyou14',
'sentnece',
'nichole1',
'123456789123456789',
'football11',
'hannah123',
'telephone',
'budlight',
'TempPassWord',
'123456as',
'kaitlyn1',
'skywalker',
'fuckyou3',
'wonderful',
'jessica123',
'AKAX89Wn',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'23232323',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'qwertyuio',
'jordan123',
'freckles',
'guadalupe',
'bubblegum',
'oblivion',
'asshole2',
'angelica1',
'esmeralda',
'deftones',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'lionking',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'blackjack',
'revolution',
'purple123',
'galatasaray',
'12345678q',
'comeon11',
'tyler123',
'radiohead',
'zxcvbnm,',
'yahoo123',
'truelove1',
'puppies1',
'rocknroll',
'lkjhgfdsa',
'february',
'linkedin123',
'russell1',
'gabriele',
'classof09',
'123456789b',
'corvette1',
'frederic',
'makaveli',
'dkflbvbh',
'fucklove',
'baller23',
'handball',
'soccer17',
'nintendo1',
'america10',
'january1',
'motherlode',
'angelina1',
'metal666',
'anthony2',
'password21',
'garrett1',
'starfish',
'spiderman2',
'caitlin1',
'abcdefghij',
'sarah123',
'justin123',
'paintball',
'anything',
'iloveyou4',
'princess11',
'sunshine2',
'1020304050',
'y6p67FtrqJ',
'princess13',
'1zn6FpN01x',
'logitech1',
'derrick1',
'pinkfloyd',
'starcraft',
'snowflake',
'stardust',
'ncc1701d',
'private1',
'newcastle1',
'football9',
'bluemoon',
'rodriguez',
'q123456789',
'lasvegas1',
'bettyboop',
'jason123',
'blueeyes',
'education',
'1b78ef23aa2506f41feecfcc45b66038',
'smallville',
'dietcoke',
'toulouse',
'daddy123',
'1a2s3d4f',
'jumpman23',
'snowboard',
'college1',
'blueberry',
'fireman1',
'19741974',
'flamingo',
'stephane',
'phantom1',
'football3',
'kissmyass1',
'riccardo',
'ilovehim',
'drowssap1',
'kingston',
'eleven11',
'anamaria',
'munchkin',
'michael123',
'mitchell1',
'hannah12',
'detroit1',
'giovanna',
'iloveyou5',
'michaela',
'anderson1',
'LinkedIn',
'25252525',
'lighthouse',
'5hsU75kpoT',
'singapore',
'katrina1',
'123456qw',
'aleksandra',
'carlitos',
'123456ab',
'justin12',
'gabriella',
'universal',
'1a2b3c4d5e',
'daniela1',
'cashmoney',
'nuttertools',
'ragnarok',
'rastaman',
'rebelde1',
'labrador',
'holiday1',
'cookie12',
'mexico13',
'warcraft3',
'blizzard',
'hamster1',
'adriana1',
'delpiero',
'cheese123',
'gonzalez',
'britney1',
'hottie12',
'thankyou',
'princess3',
'love12345',
'myspace13',
'naughty1',
'godfather',
'romashka',
'marijuana',
'valerie1',
'qwertyuio1',
'football5',
'disturbed1',
'princess!',
'f00tball',
'francis1',
'23456789',
'chocolate2',
'pizza123',
'123456qq',
'sexybitch',
'gladiator',
'xiang123456',
'vfrcbvrf',
'babygirl10',
'aaaa1111',
'skorpion',
'unicorn1',
'skate123',
'princess7',
'southpark1',
'crazy123',
'134679852',
'franklin1',
'summer06',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'philippe',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'd71lWz9zjS',
'drjynfrnt',
'cassidy1',
'789654123',
'kevin123',
'goldfish1',
'snuggles',
'amorcito',
'mackenzie',
'research',
'babyblue1',
'libertad',
'charlie2',
'blackcat',
'bethany1',
'buttons1',
'francois',
'flower123',
'phillip1',
'sunshine12',
'soccer21',
'power123',
'passwort1',
'hunting1',
'sooners1',
'12345678900',
'robinson',
'virginia1',
'baseball13',
'warriors',
'thegame1',
'cuddles1',
'nicolas1',
'jessica2',
'evolution',
'hawaii50',
'myspace5',
'zeppelin',
'trinidad',
'billybob',
'atlantis',
'woaini1314',
'mamamama',
'hottie123',
'clifford',
'rhfcjnrf',
'wordpass1',
'agnieszka',
'verbatim',
'qwertyqwerty',
'dthjybrf',
'captain1',
'sexyboy1',
'марина',
'ihateyou2',
'farfalla',
'natalia1',
'princess01',
'123456789c',
'calimero',
'ilovemymom',
'charlie123',
'soccer16',
'chemistry',
'mauricio',
'motocross',
'daisy123',
'cannabis',
'immortal',
'colorado1',
'babyboo1',
'applepie',
'cadillac',
'playstation',
'losangeles',
'fenerbahce',
'24682468',
'breanna1',
'alladin79',
'jeremiah1',
'arschloch',
'mnbvcxz1',
'semperfi',
'iw14Fi9jxL',
'vodafone',
'YfDbUfNjH10305070',
'blue1234',
'indiana1',
'marie123',
'american1',
'peter123',
'1million',
'kingkong1',
'louloute',
'carebear1',
'c43qpul5RZ',
'pussy123',
'justinbieber',
'elizabeth2',
'b9399f21060d4b5fcb6d3cf5fea8de',
'12345671',
'godbless',
'fuckyou7',
'summer12',
'fuckoff!',
'swimming1',
'123456789r',
'southside',
'1andonly',
'lavender',
'lacrosse1',
'imissyou',
'ericsson',
'lightning',
'cassandra1',
'falcons1',
'soccer23',
'19981998',
'sweetness',
'eclipse1',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'laurence',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'chrissy1',
'mastermind',
'yamahar1',
'papamama',
'layouts1',
'kristin1',
'qwertyu1',
'nevermind',
'felicidade',
'halloween',
'H2vWDuBjX4',
'alberto1',
'amandine',
'kennedy1',
'abhishek',
'priyanka',
'lovehurts1',
'wolfgang',
'cellphone1',
'friends2',
'kittykat',
'scruffy1',
'kristine',
'master12',
'zxcasdqwe',
'letmein2',
'danny123',
'morrison',
'lollypop1',
'vladislav',
'vRbGQnS997',
'austin316',
'кристина',
'surfing1',
'facebook1',
'iamthebest',
'eduardo1',
'dingdong',
'makayla1',
'sweetness1',
'sandiego',
'hunter12',
'godisgreat',
'allstar1',
'jackass2',
'football21',
'blackie1',
'chevrolet',
'hernandez1',
'skipper1',
'caramelo',
'loveless',
'batista1',
'myspace01',
'gerrard8',
'jessica12',
'ronaldo1',
'nightmare1',
'littleman1',
'backspace',
'fuckthis1',
'??????????',
'jacqueline',
'warhammer',
'anastasiya',
'cristiano',
'hello1234',
'madonna1',
'wachtwoord',
'19721972',
'southpark',
'joseluis',
'spongebob2',
'qazwsxedc123',
'starlight',
'shadow13',
'projectsadminx',
'motorola1',
'chicken2',
'sk8board',
'universe',
'kristina1',
'lincoln1',
'password14',
'x4ivygA51F',
'sexylady1',
'miami305',
'scotland1',
's8YLPe9jDPvYM',
'dirtbike1',
'michael12',
'football22',
'pearljam',
'nokia6300',
'babygirl3',
'password1234',
'skeeter1',
'nathaniel',
'victory1',
'iloveyou123',
'oscar123',
'classof08',
'a1a2a3a4',
'monkey69',
'm123456789',
'chrisbrown',
'jG3h4HFn',
'diamonds1',
'123456789t',
'peace123',
'friday13',
'солнышко',
'ironman1',
'asdfgh123',
'andrew12',
'lucas123',
'platinum1',
'mathilde',
'анастасия',
'maurice1',
'pornstar',
'rooster1',
'opensesame',
'андрей',
'hotgirl1',
'microlab',
'player69',
'microsoft1',
'iloveu123',
'michele1',
'soulmate',
'university',
'toshiba1',
'dallas214',
'ab123456',
'campbell',
'pothead1',
'sampson1',
'london12',
'pass1word',
'motherfucker',
'18atcskD2W',
'cinnamon',
'monamour',
'krystal1',
'chevelle',
'verizon1',
'0102030405',
'dominique1',
'eleonora',
'theking1',
'myspace4',
'fktrcfylhf',
'tacobell1',
'asdfghjkl;'',
'slimshady',
'redhead1',
'lovelife1',
'sherlock',
'19071907',
'mushroom',
'w66YRyBgRa',
'topolino',
'computer12',
'webhompass',
'richmond',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'r2d2c3po',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'batman123',
'michelle12',
'loveme12',
'chiquita',
'12345abcde',
'tigger12',
'Aa123456',
'project1',
'viewsonic',
'freddie1',
'baseball9',
'12345678901',
'Parola12',
'hermione',
'president',
'dedewang',
'rolltide1',
'qweasdzxc123',
'gorgeous',
'g13916055158',
'amanda123',
'X3LUym2MMJ',
'virginie',
'juancarlos',
'marathon',
'andrew123',
'babylove1',
'baseball8',
'snowflake1',
'tottenham1',
'ILOVEYOU',
'alfaromeo',
'20002000',
'katie123',
'kamikaze',
'321321321',
'nickjonas1',
'boomboom',
'vfvfgfgf',
'mexico123',
'love123456',
'hellohello',
'bitch101',
'Password123',
'catfish1',
'taekwondo',
'anthony123',
'1Fr2rfq7xL',
'keyboard',
'francisco1',
'snowboard1',
'trucker1',
'laetitia',
'james007',
'happiness1',
'amber123',
'holahola',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'babyface',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'summer123',
'deathnote',
'1234567890-',
'wolverine1',
'professional',
'roberto1',
'brittney1',
'jefferson',
'mammamia',
'vanilla1',
'desiree1',
'patience',
'asdfgh12',
'11221122',
'sasha123',
'fuckoff2',
'diosesamor',
'estrella1',
'sweet123',
'Telechargement',
'cartman1',
'harrison1',
'familyguy1',
'walmart1',
'elisabeth',
'carebear',
'azsxdcfv',
'luckydog',
'password99',
'pingpong',
'bobby123',
'qwertyuiop123',
'castillo',
'kathleen1',
'priscilla',
'killbill',
'8888888888',
'qweqwe123',
'12345654321',
'badgirl1',
'babygirl11',
'iloveyou8',
'gianluca',
'a123456a',
'onepiece',
'angel101',
'iloveyou10',
'd9Zufqd92N',
'ultimate',
'summertime',
'fussball',
'jacob123',
'paradise1',
'johnjohn',
'taylor12',
'martinez1',
'sparkle1',
'hunter123',
'mario123',
'butterfly7',
'p4ssw0rd',
'amanda12',
'jobsearch',
'marijuana1',
'syncmaster',
'fuckyou13',
'buster123',
'squirrel',
'youbye123',
'general1',
'oakland1',
'converse',
'3children',
'nounours',
'babycakes',
'honey123',
'airforce',
'01234567',
'blueberry1',
'theresa1',
'emily123',
'cucciolo',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'19691969',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'dragon13',
'nascar24',
'discovery',
'darkside',
'suckmydick',
'jenny123',
'yellow12',
'ilovemusic',
'annabelle',
'beyonce1',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'ashleigh',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'369852147',
'networking',
'abcdef123',
'24681012',
'summer11',
'mackenzie1',
'huhbbhzu78',
'download',
'national',
'69camaro',
'ilovegod1',
'designer',
'guillaume',
'business1',
'iloveher1',
'socrates',
'asshole123',
'soccer18',
'buffalo1',
'chargers',
'1truelove',
'rochelle',
'student1',
'voyager1',
'nokia123',
'Qwerty123',
'godisgood1',
'softball12',
'j123456789',
'cooldude1',
'cheese12',
'backspace1',
'nopassword',
'abdullah',
'87654321q',
'hellfire',
'valentine1',
'domenico',
'renegade',
'pikachu1',
'abracadabra',
'20012001',
'harmony1',
'tarheels',
'634142554',
'123mudar',
'chandler1',
'hendrix1',
'8ix6S1fceH',
'packers4',
'billybob1',
'qwertyuiop1',
'stoner420',
'werewolf',
'wolfpack',
'love4life',
'johannes',
'tigger123',
'playboy69',
'jeffhardy1',
'brandon2',
'gsxr1000',
'qwegta13091990',
'neopets12',
'my3girls',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'faithful',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'12qw34er',
'cfitymrf',
'flamengo',
'caterina',
'baseball4',
'westham1',
'football23',
'brucelee',
'123456789n',
'telefono',
'airborne',
'smile4me',
'babylon5',
'omarion1',
'buster12',
'jesuschris',
'3333333333',
'maximilian',
'amazing1',
'attitude',
'univers2l',
'shadow11',
'myspace10',
'santiago1',
'fantasy1',
'25251325',
'15426378',
'bentley1',
'chargers21',
'estrellita',
'primavera',
'treasure',
'lorenzo1',
'soldier1',
'trigger1',
'mersedes',
'milagros',
'water123',
'bubbles2',
'margaret1',
'samsung123',
'nokian73',
'1q2w3e4r5t6y7u',
'yellow123',
'fernandez',
'anthony12',
'doberman',
'kingdom1',
'summer10',
'fuckfuck',
'coldplay',
'matematica',
'clayton1',
'anaconda',
'qweasdzxc1',
'welcome2',
'godzilla1',
'whocares',
'kickass1',
'katelyn1',
'felicidad',
'19701970',
'asdfg12345',
'fuckyou666',
'damilola',
'princess5',
'sandiego1',
'angelika',
'sexylady',
'6666666666',
'123456789g',
'godfather1',
'ilovemom1',
'bangladesh',
'nascar88',
'sexybeast1',
'presario',
'mohammad',
'joshua12',
'dragonfly1',
'p@ssword',
'bastard1',
'johndeere',
'porkchop',
'school123',
'football13',
'l1nk3d1n',
'baseball22',
'moneymaker',
'mariposa1',
'babyphat1',
'iforgot1',
'london123',
'eastside',
'1qaz!QAZ',
'beckham7',
'mountain1',
'geraldine',
'vfhufhbnf',
'messenger',
'1football',
'puertorico',
'michelle2',
'dfktynbyf',
'musicman',
'michael7',
'sayangku',
'thomas12',
'flower12',
'batman12',
'senha123',
'rainbow6',
'megadeth',
'excalibur',
'mississippi',
'asd12345',
'viktoriya',
'александр',
'information',
'armagedon',
'snuggles1',
'abc123abc',
'freestyle',
'security1',
'shirley1',
'kakashka',
'fuckyou22',
'harrypotte',
'johndeere1',
'zxcvbnm12',
'13243546',
'love2010',
'elefante',
'iloveme!',
'q1234567',
'wildcat1',
'doraemon',
'bitchass1',
'01230123',
'buckeyes',
'alexandr',
'roadrunner',
'darkstar',
'p0o9i8u7',
'international',
'baby1234',
'testing123',
'trumpet1',
'satellite',
'mississipp',
'princesita',
'iloveyou69',
'houston713',
'chicken123',
'angelique',
'fucking1',
'moneyman1',
'brittney',
'joker123',
'ilovemyself',
'scvMOFAS79',
'sailormoon',
'lalalala',
'marjorie',
'teamo123',
'rodriguez1',
'ilikepie',
'pussycat1',
'soccer09',
'goodgirl',
'babyface1',
'sundance',
'soccer101',
'виктория',
'scorpion1',
'sexy1234',
'amarillo',
'cardinal',
'anything1',
'mama1234',
'airplane',
'angelbaby1',
'honeybee',
'hollister2',
'home0401',
'tacobell',
'kisskiss',
'summer69',
'cardinals1',
'tootsie1',
'20202020',
'paramore1',
'iloveme123',
'december12',
'qwerty13',
'spartan1',
'thomas123',
'myspace08',
'kendall1',
'nintendo64',
'nathaniel1',
'chelsea123',
'jordan11',
'letmein123',
'evangelion',
'english1',
'alexandru',
'ilovejusti',
'yfcntymrf',
'megasecret',
'babygirl14',
'supernova',
'jesusislord',
'katarina',
'cristina1',
'catarina',
'carlos123',
'1fuckyou',
'puppy123',
'lovergirl1',
'trinity3',
'jesusis1',
'christy1',
'michael3',
'lawrence1',
'noodles1',
'fuckface1',
'whatsup1',
'wrangler',
'babygirl01',
'family123',
'bubba123',
'z1x2c3v4',
'emmanuel1',
'television',
'dannyboy',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'whiskers',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'manunited',
'malaysia',
'7253497a5e31bd64',
'chivas10',
'myspace101',
'qaz123456',
'chronic1',
'qwerasdfzxcv',
'goddess1',
'baseball21',
'74108520',
'jimmy123',
'thirteen13',
'gameover',
'happyday',
'gilbert1',
'lowrider',
'jeffhardy',
'purple11',
'hondacivic',
'feder_1941',
'simpleplan',
'lovehurts',
'hellothere',
'dkflbckfd',
'alex1234',
'wow12345',
'waheguru',
'halloween1',
'sanchez1',
'пїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅ',
'1й2ц3у',
'frances1',
'princesa1',
'purple13',
'monkey01',
'123456789w',
'mobster1',
'megaman1',
'iloveyou23',
'iamnumber1',
'surside13',
'741258963',
'19711971',
'gotohell',
'delphine',
'kawasaki1',
'hannibal',
'stalker1',
'oklahoma',
'bordeaux',
'q2w3e4r5',
'sunshine7',
'administrator',
'manager1',
'pavilion1',
'sylvester',
'orange123',
'cherry123',
'coconut1',
'fredfred',
'monkey10',
'thompson',
'classof201',
'myspace9',
'123456789e',
'babybaby',
'????????',
'santana1',
'standard',
'sandy123',
'orange12',
'lovesucks1',
'woodstock',
'dragon11',
'chloe123',
'margarita1',
'QWERTYUIOP',
'rootbeer',
'taylor123',
'hotmama1',
'loveyou123',
'trombone',
'pepper12',
'marino13',
'hockey12',
'memphis1',
'matthew2',
'kayleigh',
'hollister',
'dietcoke1',
'capslock',
'22446688',
'maggie12',
'princess14',
'pirates1',
'morpheus',
'lesbian1',
'20022002',
'alexander2',
'01010101',
'mexico12',
'sexymama',
'lokomotiv',
'football4',
's123456789',
'dangerous',
'electric',
'827ccb0eea8a706c4c34a16891f84e7b',
'123456789f',
'freebird',
'redbull1',
'12345600',
'penguins',
'password15',
'starbucks1',
'cookiemons',
'arianna1',
'whatever!',
'chipper1',
'littleman',
'6V21wbgad',
'kittykat1',
'tarheels1',
'emanuele',
'giggles1',
'chivas11',
'trooper1',
'az123456',
'smackdown',
'kangaroo',
'whiskey1',
'football8',
'alexandria',
'summer01',
'bangalore',
'sunny123',
'brandon123',
'shitface1',
'punkrock1',
'salvation',
'penis123',
'umbrella',
'legolas1',
'akatsuki',
'123456789h',
'456456456',
'myfamily',
'mazda626',
'jonas123',
'skater123',
'faithful1',
'leonardo1',
'dont4get',
'brandon12',
'qwert1234',
'polopolo',
'cheesecake',
'159753456',
'myspace23',
'william2',
'shadow01',
'junior123',
'jasmine2',
'princess21',
'welcome12',
'motherfuck',
'rachael1',
'ilovemom',
'kentucky1',
'souljaboy1',
'supergirl',
'qwaszx12',
'blackjack1',
'rocknroll1',
'guillermo',
'corazon1',
'mymother',
'magic123',
'demon666',
'qqqq1111',
'krasotka',
'yomomma1',
'bobmarley1',
'nicole13',
'johnlock',
'roxanne1',
'mother123',
'friends123',
'hunter01',
'robert123',
'yamahar6',
'windows7',
'warriors1',
'changeme1',
'123йцу',
'princess22',
'11111111111',
'passport1',
'griffin1',
'19051905',
'kamasutra',
'brigitte',
'12345678s',
'никита',
'gabrielle1',
'fyutkbyf',
'salvador1',
'1q1q1q1q',
'123456781',
'nicole11',
'biscuit1',
'kelly123',
'camille1',
'myspace22',
'secret666',
'pimpdaddy1',
'birthday1',
'aaron431',
'blackdog',
'babygirl7',
'monopoly',
'ilovesex',
'kayla123',
'123abc123',
'789789789',
'1212121212',
'frogger1',
'dancing1',
'wonderland',
'joshua123',
'laura123',
'matthias',
'cutie101',
'fletcher',
'animals1',
'daredevil',
'kristian',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'shanghai',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'gabriela1',
'stratfor',
'любимая',
'password09',
'jeanette',
'spitfire1',
'lowrider1',
'maggie123',
'komputer',
'eatshit1',
'zaqxswcde',
'000webhost',
'thug4life',
'grandpa1',
'annette1',
'rachelle',
'ji394su3',
'dragon69',
'kentucky',
'america123',
'choupette',
'pokemon2',
'ichliebedich',
'shotgun1',
'prettyboy1',
'asdfghj1',
'mittens1',
'lol12345',
'forzamilan',
'positive',
'dragonballz',
'software',
'buckeyes1',
'bubbles123',
'мамочка',
'myspace09',
'19681968',
'harry123',
'rooney10',
'kathryn1',
'abrakadabra',
'marihuana',
'sexsexsex',
'fabrizio',
'pallmall',
'marilyn1',
'cherokee1',
'Alexander',
'Megaparol',
'liverpool8',
'mexico10',
'guardian',
'infiniti',
'smackdown1',
'monster123',
'hayabusa',
'qqqqqqqqqq',
'baseball23',
'starbucks',
'seattle1',
'sassy123',
'monkey23',
'clarence',
'beethoven',
'123456789abc',
'sunshine3',
'jupiter1',
'leavemealone',
'hurricane',
'sagitario',
'guadalupe1',
'mmmmmmmm',
'hooters1',
'justine1',
'bernardo',
'starcraft1',
'lancelot',
'iloveyou21',
'stargate1',
'lolipop1',
'princess4',
'vfitymrf',
'stefanie',
'maksimka',
'rootbeer1',
'mazdarx7',
'fuckyou5',
'00112233',
'charlie12',
'123456789.',
'bubbles12',
'brendan1',
'rebound1',
'passpass',
'mongoose',
'camaroz28',
'jasmine123',
'1234567m',
'lovingyou',
'kleopatra',
'motocross1',
'unknown1',
'tazmania',
'portugal1',
'original',
'butterfly3',
'preciosa',
'bowling1',
'diamante',
'pepsi123',
'linda123',
'963258741',
'hercules1',
'4myspace',
'pandora1',
'volkswagen',
'nikki123',
'nigga123',
'goldberg',
'123698741',
'zacefron1',
'jazmine1',
'1234zxcv',
'su123456',
'topsecret',
'ginger12',
'teddy123',
'ashley11',
'thesims2',
'asdfzxcv',
'together',
'neveragain',
'soccer19',
'stranger',
'samantha12',
'colleen1',
'ilovechris',
'любимый',
'bellissima',
'peterpan1',
'principessa',
'titanic1',
'pornstar1',
'asdasd666',
'ms0083jxj',
'joejonas1',
'jordan01',
'myspace69',
'lillian1',
'vancouver',
'missy123',
'dance123',
'butthole1',
'nacional',
'12312312',
'bkl29m2bk',
'14141414',
'pothead420',
'start123',
'babyboy2',
'mylove123',
'yolanda1',
'capricorn1',
'linkedin2011',
'stingray',
'qazxsw123',
'hannah01',
'mustang2',
'iloveyou9',
'gonzales',
'moonlight1',
'fgtkmcby',
'1sunshine',
'swimmer1',
'mylinkedin',
'dirtbike',
'asdfghjkl123',
'incorrect',
'wallace1',
'skater12',
'daniel01',
'dorothy1',
'techn9ne',
'loredana',
'jesussaves',
'moneyman',
'lalala123',
'a1s2d3f4g5',
'brayden1',
'azertyui',
'1234rewq',
'myspace8',
'princess23',
'chivas123',
'5plK4L5Uc7',
'12qw12qw',
'sandman1',
'punisher',
'longhorn',
'konstantin',
'bigpimpin1',
'bearbear',
'slipknot6',
'panda123',
'fuckyou11',
'lonewolf',
'charger1',
'king1234',
'iloveu12',
'megan123',
'temp1234',
'<password>',
'gretchen',
'josefina',
'escorpion',
'robert12',
'register',
'cleveland',
'director',
'senior09',
'computer2',
'septiembre',
'gandalf1',
'1234567j',
'married1',
'marcello',
'jesusfreak',
'shakira1',
'chickens',
'allah786',
'redwings1',
'mickeymouse',
'mallorca',
'fallout3',
'jordan13',
'madeline1',
'mV46VkMz10',
'koolaid1',
'cardinals',
'gamecube',
'austin12',
'felicia1',
'dominican1',
'bighead1',
'darkangel1',
'ilove123',
'cowgirl1',
'iamcool1',
'mission1',
'respect1',
'portland',
'armando1',
'love2009',
'columbia',
'anthony3',
'stunt101',
'qwerty77',
'november11',
'isabelle1',
'celeste1',
'madagascar',
'celtic1888',
'madeleine',
'bugsbunny',
'ashley13',
'1iloveyou',
'ohiostate1',
'argentina1',
'meredith',
'simpson1',
'finalfantasy',
'madison2',
'jeffery1',
'computador',
'basketbal1',
'slipknot66',
'coolgirl',
'durango1',
'cavalier',
'meowmeow',
'babygirl15',
'ordinateur',
'Pa55word',
'children3',
'incubus1',
'woaiwojia',
'freckles1',
'15151515',
'123456aaa',
'honduras',
'maryjane42',
'warszawa',
'babygirl5',
'fabulous',
'1qazzaq1',
'20052005',
'123321123321',
'3.1415926',
'coolman1',
'teamomucho',
'shorty13',
'rammstein1',
'qwerty777',
'longhorns',
'happydays',
'anthony7',
'mileycyrus',
'harley01',
'showtime',
'asd123asd',
'z123456789',
'123123123123',
'abcde123',
'пїЅпїЅпїЅпїЅпїЅпїЅ@mail.ru',
'superman7',
'ilovehim2',
'google12',
'imnumber1',
'guitarra',
'baseball24',
'secret123',
'mariana1',
'pepper123',
'girasole',
'classic1',
'multiplelog',
'myspace0',
'tabitha1',
'deftones1',
'gizmo123',
'cheer123',
'lifesucks1',
'Jennifer',
'valentina1',
'bernard1',
'Abcd1234',
'babygurl12',
'peekaboo',
'fuckface',
'violetta',
'mechanical',
'daniel11',
'168ASD168',
'sexylove1',
'redalert',
'shorty12',
'12211221',
'chivas12',
'budweiser',
'superman3',
'iverson1',
'bumblebee',
'arsenal123',
'newpassword',
'ginger123',
'bigmoney',
'yankees13',
'1357913579',
'wellington',
'bunny123',
'789632145',
'braveheart',
'mercury1',
'puppylove1',
'wonderful1',
'1234567s',
'venezuela',
'hellsing',
'revenge1',
'applepie1',
'racecar1',
'7777777a',
'monkey101',
'monkey21',
'cleveland1',
'blueeyes1',
'bigmoney1',
'123456789qwe',
'password88',
'junebug1',
'19991999',
'music101',
'19031903',
'sterling1',
'lemonade',
'tigger01',
'1z2x3c4v',
'!qaz2wsx',
'dortmund',
'gorgeous1',
'hustler1',
'hockey11',
'school12',
'il0veyou',
'cantona7',
'W5tn36alfW',
'vendetta',
'waterloo',
'lightning1',
'technics',
'spectrum',
'princess15',
'playboy123',
'thankgod',
'georgina',
'broadway',
'demon123',
'central1',
'babygirl09',
'crip4life',
'peanut12',
'maradona10',
'lifesucks',
'clifford1',
'chicken12',
'ashleigh1',
'michael23',
'Michael1',
'1qay2wsx',
'19671967',
'tenerife',
'teiubesc',
'mckenzie',
'firebird1',
'baseball14',
'annamaria',
'chemical',
'testing1',
'beckham23',
'steelers7',
'miracle1',
'mariajose',
'coolkid1',
'c.ronaldo',
'pooppoop',
'softball11',
'heineken',
'1111qqqq',
'qwertyui1',
'emachines1',
'brighton',
'abcd123456',
'password24',
'baseball6',
'jasmine12',
'grizzly1',
'cruzazul',
'babygirl!',
'northside1',
'addison1',
'1й2ц3у4к',
'senior08',
'youtube1',
'carlotta',
'stewart1',
'scooter2',
'0192837465',
'joshua01',
'theused1',
'qdujvyG5sxa',
'pakistan123',
'oklahoma1',
'valeria1',
'candice1',
'overlord',
'1michael',
'rockets1',
'porcodio',
'imperial',
'astonvilla',
'emiliano',
'tommy123',
'aerosmith',
'tequila1',
'briciola',
'helloworld',
'jermaine1',
'semperfi1',
'dylan123',
'sonyericsson',
'nokia5800',
'junior12',
'qwer4321',
'diamond2',
'lionheart',
'sullivan',
'money100',
'chevys10',
'mickey12',
'jessica3',
'qwerty78',
'left4dead',
'ssyu1314',
'football!',
'111111111111',
'bookmark',
'123456abcd',
'daniel13',
'classof200',
'aaron123',
'sexyman1',
'lamborghini',
'honduras1',
'rainbows',
'jillian1',
'159159159',
'westwood',
'girlfriend',
'zaqwsxcde',
'sunshine!',
'mustangs',
'noisette',
'margherita',
'coolcool',
'password19',
'password08',
'mickey123',
'123qwe123qwe',
'highlander',
'19651965',
'passwords',
'network1',
'thirteen',
'ilikepie1',
'zeppelin1',
'whatever2',
'nicole01',
'chelseafc',
'blossom1',
'xboxlive',
'lampard8',
'football24',
'daniella',
'myspace07',
'classof07',
'20072007',
'daughter',
'333333333',
'adventure',
'football20',
'andrew11',
'chevrolet1',
'100200300',
'softball2',
'45454545',
'.adgjmptw',
'23jordan',
'poptart1',
'evergreen',
'compton1',
'fuckthis',
'forzaroma',
'123456789v',
'm1234567',
'glitter1',
'aaaaaaa1',
'0147258369',
'guatemala',
'iloveyou09',
'cheetah1',
'friends!',
'shorty123',
'cadillac1',
'lorraine1',
'carlos12',
'webster1',
'lifeisgood',
'Michelle',
'softball10',
'theodore',
'rdfhnbhf',
'starlight1',
'softball7',
'zzzzzzzzzz',
'justin11',
'poseidon',
'jennifer12',
'october10',
'godislove1',
'chivas13',
'peanuts1',
'clarinet',
'italian1',
'supergirl1',
'silverado',
'lenochka',
'iloveyou15',
'12345qwer',
'commando',
'porkchop1',
'stanislav',
'music4life',
'qwerty69',
'meandyou',
'cucciola',
'munchkin1',
'george123',
'flipper1',
'whiteboy1',
'nightwish',
'principe',
'ilovemysel',
'1234567z',
'front242',
'пїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅпїЅ',
'fuckyou6',
'iloveyou6',
'handsome1',
'coolcat1',
'159753123',
'twilight12',
'lipgloss1',
'christian2',
'aptx4869',
'crjhgbjy',
'forzainter',
'freedom2',
'soccer08',
'halflife',
'myspace200',
'contraseña',
'albatros',
'killer13',
'princess8',
'livelife',
'budweiser1',
'jackjack',
'emerald1',
'blessings',
'solomon1',
'soccer07',
'holland1',
'14881488',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'resident',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'zxcvb123',
'control1',
'bailey12',
'america12',
'justin01',
'hannah11',
'rainbow123',
'a1a2a3a4a5',
'123456qwer',
'йцукенгшщз',
'thomas22',
'ssssssss',
'jessica7',
'myspace201',
'dr.pepper',
'blackbird',
'kittens1',
'jamesbond007',
'dfg5Fhg5VGFh1',
'seniseviyorum',
'babygirl21',
'friends4',
'pistons1',
'12345677',
'fuckyou4',
'spanish1',
'confused1',
'tecktonik',
'geoffrey',
'candycane1',
'1a2a3a4a',
'bengals1',
'abcdefgh1',
'p455w0rd',
'jessica13',
'1diamond',
'love2008',
'chivas100',
'bernadette',
'22334455',
'veronique',
'martin123',
'cecilia1',
'brothers',
'baseball15',
'plymouth',
'enrique1',
'summer05',
'killer11',
'jerusalem',
'cowboys22',
'simon123',
'XBLhInTB9w',
'tomorrow',
'spartans',
'alexis12',
'476730751',
'notebook',
'7uGd5HIp2J',
'456789123',
'giovanni1',
'00001111',
'soccer01',
'matthew12',
'barbie123',
'huskers1',
'babygirl23',
'youandme',
'history1',
'babygirl16',
'frederick',
'maggie01',
'softball13',
'leonard1',
'beautiful2',
'clemson1',
'kobebryant',
'password20',
'princess16',
'paperino',
'sephiroth',
'innocent',
'73501505',
'chronic420',
'J1V1fp2BXm',
'iloveyouba',
'home1234',
'gabriel123',
'jamie123',
'nokian70',
'clarissa',
'juventus1',
'martina1',
'lineage2',
'football09',
'ashley01',
'goodbye1',
'zxc123456',
'hamilton1',
'cristian1',
'couponSC10',
'woaini520',
'murcielago',
'buster01',
'ncc1701a',
'medicina',
'fighter1',
'soccer24',
'soccer20',
'milkshake1',
'buckeye1',
'maurizio',
'123admin321',
'atlars10',
'mikejones1',
'85208520',
'123stella',
'florencia',
'5X1CJdsb9p',
'winchester',
'nigger123',
'йцукенгшщзхъ',
'gertrude',
'aa123123',
'sadie123',
'freeman1',
'123456zxc',
'vacation1',
'il0vey0u',
'bugsbunny1',
'rastafari',
'20062006',
'hardrock',
'mallory1',
'1234509876',
'jocelyn1',
'explorer1',
'lovergirl',
'password07',
'loveislife',
'jesse123',
'confused',
'nokian95',
'account1',
'marseille13',
'hurricane1',
'qwerty666',
'20112011',
'scarlett1',
'daniel19',
'pinkfloyd1',
'mark_963',
'livestrong',
'1butterfly',
'twister1',
'billy123',
'lovely12',
'hm9958123',
'asshole12',
'a1a1a1a1',
'francine',
'family12',
'bigfoot1',
'amsterdam1',
'morning21',
'redsox04',
'gfhjkm123',
'qwerty22',
'tatiana1',
'september9',
'bailey123',
'dragon01',
'@bigmir.net',
'superfly',
'manning18',
'number12',
'ilovehim!',
'1anthony',
'14121412',
'mazda323',
'melinda1',
'19641964',
'tkbpfdtnf',
'starfish1',
'princess9',
'candyman',
'butterfly8',
'terrell1',
'jingjing',
'rockstar12',
'010203040506',
'panasonic1',
'hotpink1',
'aaaaaaaaa',
'almighty',
'??????@mail.ru',
'bridget1',
'macarena',
'1q2w3e4r5t6y7u8i',
'sexybaby1',
'andrew01',
'scarlet1',
'meatball',
'какашка',
'qwertyuiop12',
'1qazxsw23edc',
'малышка',
'1213141516',
'Princess',
'training',
'hunter11',
'buddyboy',
'24242424',
'charlie3',
'lovely123',
'raiderz1',
'deadman1',
'mystery1',
'shooter1',
'pauline1',
'linkedln',
'disturbed',
'786786786',
'adelaide',
'1zxcvbnm',
'bluebird1',
'rjycnfynby',
'nursing1',
'hgrFQg4577',
'lauren12',
'monkeybutt',
'joseph12',
'sophie123',
'booboo12',
'friends12',
'deborah1',
'lexmark1',
'keyboard1',
'remington',
'babygirl69',
'barbados',
'xiaoxiao',
'ghjcnjnfr',
'blizzard1',
'landrover',
'italiano',
'd123456789',
'fireball1',
'5845201314',
'matthew123',
'london22',
'davidson',
'blackrose',
'banana11',
'sidekick3',
'babygirl22',
'arsenal14',
'annalisa',
'thomas01',
'milkshake',
'michael11',
'gorilla1',
'surenos13',
'princess19',
'newstart',
'malcolm1',
'mollydog',
'football14',
'1234567890-=',
'ilovepussy',
'christelle',
'extreme1',
'trojans1',
'hottie13',
'концертных площадок и умных студентов:',
'chocolate!',
'sherman1',
'nathan12',
'comcast1',
'W1aUbvOQ',
'sparkles',
'waterfall',
'oliveira',
'password17',
'jordan10',
'rbOTmvZ954',
'raffaele',
'navigator',
'playstation3',
'cellphone',
'135798642',
'summer2010',
'monkey14',
'password16',
'yangyang',
'spike123',
'qwerty01',
'andrea123',
'123456789*',
'millwall',
'booboo123',
'radiohead1',
'deutschland',
'dt123456',
'william123',
'naruto11',
'softball3',
'krokodil',
'honda123',
'darkstar1',
'caramel1',
'2children',
'love4you',
'carolyn1',
'Blink123',
'ncc1701e',
'koroleva',
'love5683',
'michael13',
'jermaine',
'monster2',
'mike1234',
'fucklove13',
'firefly1',
'peanut123',
'slimshady1',
'ihateyou!',
'holly123',
'liverpool9',
'hospital',
'cepetsugih',
'blueblue',
'shamrock1',
'mickeymous',
'rjhjktdf',
'19631963',
'Sunshine',
'babygirl4',
'homework',
'converse1',
'cookies123',
'twinkle1',
'opelastra',
'mother12',
'badminton',
'fucku123',
'cinnamon1',
'qw123456',
'iloveher',
'myspace21',
'makaveli1',
'julia123',
'crosby87',
'princess09',
'yfdbufnjh63',
'nissan350z',
'victoire',
'nathan123',
'contrasena',
'babygirl19',
'cherry12',
'knights1',
'asshole!',
'google.com',
'bossman1',
'snoopdog',
'apples123',
'purple22',
'password77',
'killer666',
'fisherman',
'besiktas',
'Sample123',
'babatunde',
'godsmack',
'believe1',
'skinhead',
'21122112',
'kochanie',
'fuckyoubit',
'bushido1',
'pedro123',
'mandarin',
'champagne',
'august12',
'asd666fds',
'gameboy1',
'evanescence',
'123456qaz',
'qwertasdfg',
'pancakes',
'123456798',
'marcella',
'diego123',
'skywalker1',
'michaeljac',
'ячсмит',
'theboss1',
'pokemon11',
'01011980',
'fxzZ75yer',
'19661966',
'tweetybird',
'banana123',
'vittoria',
'harley123',
'fantasia',
'bmx4life',
'summer99',
'fuckyou8',
'greenday12',
'zxcasdqwe123',
'familia1',
'taylor01',
'cutegirl',
'carmelo15',
'wsbe279qSG',
'professor',
'password33',
'frank123',
'zxcvb12345',
'liverp00l',
'gymnast1',
'donovan1',
'forever2',
'sasuke12',
'nicole22',
'woaini123',
'pudding1',
'rhiannon',
'poochie1',
'everything',
'guerrero',
'fuckme123',
'blackops',
'bangbang',
'pioneer1',
'bailey01',
'Letmein1',
'thursday',
'survivor',
'polaris1',
'anarchy1',
'pharmacy',
'matilda1',
'liverpool2',
'star1234',
'666666666',
'Charlie1',
'francisca',
'dallas22',
'coolguy1',
'myspace14',
'1superman',
'ilovemybab',
'dominika',
'badbitch1',
'grace123',
'heartbreak',
'dragon88',
'pasword1',
'guatemala1',
'offspring',
'diablo666',
'malachi1',
'ромашка',
'klapaucius',
'guinness1',
'grenouille',
'lovehate',
'ludacris',
'lalaland',
'october31',
'prashant',
'mitsubishi',
'stallion',
'kirsten1',
'abcd12345',
'babygirl08',
'blingbling',
'blackman',
'princess08',
'lovesucks',
'iloveyou08',
'123soleil',
'yellow11',
'mash4077',
'987654321q',
'1q2w3e4r5t6y7u8i9o',
'suzanne1',
'mermaid1',
'cherries',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'bookworm',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'mynameis',
'1a2s3d4f5g',
'pinky123',
'logan123',
'2bornot2b',
'wednesday',
'monster12',
'thedoors',
'emerica1',
'darling1',
'ghblehjr',
'bonjour1',
'miguelito',
'austin123',
'pr1ncess',
'poohbear12',
'nickjonas',
'andre123',
'harley12',
'12345678m',
'richmond1',
'juanita1',
'anuradha',
'pimping1',
'andreas1',
'elsalvador',
'555555555',
'sweety12',
'maryland',
'aberdeen',
'snoopy123',
'moncoeur',
'springer',
'nssadmin',
'goodness',
'battlefield',
'hottie11',
'12345678900987654321',
'butthole',
'456123789',
'printer1',
'destiny2',
'сергей',
'tropical',
'raiders13',
'56565656',
'bionicle',
'sexyback1',
'246813579',
'theonly1',
'rainbow2',
'playstatio',
'jefferson1',
'telephone1',
'novembre',
'saturday',
'godofwar',
'asdfghjk1',
'pasquale',
'sinaloa1',
'mushroom1',
'sunshine11',
'pazzword123',
'fkbyjxrf',
'fabregas',
'cambridge',
'michael01',
'mamochka',
'alexis09',
'superman11',
'gymnastics',
'number11',
'lucifer666',
'kIkeunyw',
'fuckyou9',
'brian123',
'123asd123',
'солнце',
'lucky777',
'owt243yGbJ',
'lovestory',
'casey123',
'147896321',
'kifj9n7bfu',
'fuckoff123',
'nicole21',
'asdffdsa',
'puppylove',
'edward123',
'cutiepie12',
'k2010302',
'jaihanuman',
'alfred19',
'zimmer483',
'robinhood',
'qwerty789',
'fabienne',
'michael5',
'paper123',
'penelope1',
'morgan12',
'iloveyou16',
'john!20130605at1753',
'ichliebedi',
'dynasty1',
'catwoman',
'password18',
'toronto1',
'1qaz!qaz',
'bonehead',
'yourmom2',
'thegreat1',
'rencontre',
'caliente',
'desperado',
'rhjrjlbk',
'luckydog1',
'elliott1',
'stonecold1',
'ячсмить',
'crevette',
'wedding1',
'a1111111',
'margarida',
'daniel10',
'joseph123',
'ghostrider',
'j1234567',
'america2',
'pretty12',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'zanzibar',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'Eh1K9oh335',
'montecarlo',
'kakashi1',
'seventeen',
'peaceout',
'oranges1',
'123456789A',
'filomena',
'anthony13',
'monkeyman1',
'marcopolo',
'babygirl20',
'pokerface',
'diciembre',
'baller12',
'technology',
'babygirl9',
'kingking',
'littlebit1',
'2wsx3edc',
'20032003',
'1234567b',
'sharingan',
'taylor11',
'concrete',
'armstrong',
'superman23',
'chivas#1',
'twisted1',
'1234567d',
'bradford',
'candygirl1',
'alfredo1',
'aaa123123',
'ballin23',
'2blessed',
'tweety12',
'blaze420',
'myspace6',
'Benjamin',
'19411945',
'lobster1',
'jonathan12',
'pimpin69',
'mustang69',
'1chicken',
'sunderland',
'trinidad1',
'ramones1',
'borussia',
'underoath1',
'Linkedin1',
'splinter',
'littlebit',
'justin13',
'trenton1',
'running1',
'management',
'priscilla1',
'progress',
'chicken!',
'philips1',
'diana123',
'qazqazqaz',
'екатерина',
'bretagne',
'hahaha123',
'sneakers',
'faith123',
'angelbaby',
'19191919',
'12348765',
'patriots12',
'matthieu',
'a987654321',
'supermario',
'алексей',
'bryant24',
'78963214',
'minouche',
'dontforget',
'crepusculo',
'nicole14',
'children1',
'texas123',
'november19',
'qaz123wsx',
'mmmmmmmmmm',
'angelita',
'startrek1',
'hedgehog',
'hooligan',
'k123456789',
'eminem123',
'tennessee1',
'qwerty21',
'children2',
'greenbay',
'?????????',
'samuel01',
'edward12',
'51505150',
'budapest',
'jesus4me',
'colocolo',
'123456789i',
'cupcakes',
'pretty123',
'password12345',
'4children',
'gamecube1',
'fabulous1',
'TOPBUTTON',
'319f4d26e3c536b5dd871bb2c52e3178',
'pontiac1',
'ferdinand',
'makemoney',
'xxxxxxxxxx',
'my.space',
'darlene1',
'angeline',
'naruto13',
'Liverpool',
'mckenzie1',
'ghbywtccf',
'loveyou12',
'mikemike',
'boobear1',
'rainbow7',
'qwertzuiop',
'&hearts;',
'selenagome',
'nokia3310',
'Password01',
'brandon3',
'mostwanted',
'alexis123',
'polarbear',
'pleasure',
'charlie7',
'pink1234',
'pringles',
'estefania',
'hockey10',
'buster11',
'solution',
'jasmine3',
'football33',
'boomboom1',
'nicole10',
'bautista',
'football6',
'august11',
'aaa123456',
'9293709b13',
'sonic123',
'fordf250',
'tigger11',
'romance1',
'bonjovi1',
'birdman1',
'aardvark',
'florence1',
'sexygurl1',
'discover',
'hogwarts',
'eldorado',
'1qaz@wsx',
'anthony5',
'4444444444',
'tinkerbel1',
'mygirls2',
'marlene1',
'fantastic',
'Passwort',
'supersonic',
'ilovejosh1',
'crackhead1',
'snoopdogg',
'senior07',
'illusion',
'sharpie1',
'0147852369',
'74107410',
'12345qaz',
'whiskers1',
'shinigami',
'fuckmylife',
'alexalex',
'danielle12',
'jack1234',
'123456789asd',
'belinda1',
'mazafaka',
'cachorro',
'desmond1',
'sasuke123',
'johanna1',
'impossible',
'deerhunter',
'chihuahua',
'grandkids',
'samurai1',
'architect',
'wishbone',
'liliana1',
'killers1',
'светлана',
'tequiero1',
'vanhalen',
'robinson1',
'joshua11',
'guilherme',
'blessing1',
'michael!',
'8PHroWZ624',
'matthew3',
'bluesky1',
'rosemary1',
'lover101',
'chocolate7',
'20082009',
'loveless1',
'iw14Fi9jwQa',
'1melissa',
'taylor13',
'fuckoff69',
'football08',
'columbus',
'weare138',
'hotchick1',
'operator',
'longhorn1',
'goodlife',
'underworld',
'qwerty99',
'tricolor',
'falcons7',
'yahoomail',
'fuckyou23',
'superman13',
'smokeweed1',
'kayleigh1',
'sarajevo',
'patrizia',
'kathmandu',
'iloveyou<3',
'fullmoon',
'crimson1',
'andrea12',
'1111111a',
'iloveyou01',
'capoeira',
'123123qwe',
'momanddad',
'friends4ev',
'charlie01',
'bigsexy1',
'sailboat',
'25800852',
'aaaaaaaaa1',
'poop1234',
'minicooper',
'jessica11',
'promise1',
'chocolate3',
'aurelien',
'gribouille',
'creation',
'4everlove',
'dutchess',
'steven123',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'starstar',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'fearless',
'anonymous',
'crusader',
'downtown',
'achilles',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'firewall',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'canadian',
'cucumber',
'sheridan',
'wireless',
'atlantic',
'wildfire',
'highland',
'alphabet',
'webmaster',
'question',
'nebraska',
'bullseye',
'valhalla',
'criminal',
'crackers',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'insomnia',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'terminal',
'paranoid',
'doomsday',
'reynolds',
'magician',
'intrepid',
'dynamite',
'username',
'sherwood',
'moonbeam',
'honolulu',
'crawford',
'southern',
'sunlight',
'cerberus',
'republic',
'recovery',
'intruder',
'hastings',
'goldstar',
'commander',
'blackout',
'yesterday',
'phillips',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'monsters',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'keystone',
'grateful',
'continue',
'triangle',
'peterson',
'mandrake',
'hardware',
'ferguson',
'dominick',
'bullfrog',
'transfer',
'shepherd',
'property',
'pictures',
'mischief',
'macintosh',
'daffodil',
'charming',
'underdog',
'alliance',
'adrienne',
'sentinel',
'richards',
'mortimer',
'magazine',
'infantry',
'hopeless',
'fandango',
'deadhead',
'christie',
'billyboy',
'absolute',
'titanium',
'superior',
'spaceman',
'somebody',
'sinclair',
'pppppppp',
'military',
'felicity',
'brewster',
'valkyrie',
'chuckles',
'saratoga',
'majestic',
'kingfish',
'japanese',
'graphics',
'flounder',
'coltrane',
'checkers',
'augustus',
'washburn',
'stanford',
'rasputin',
'overkill',
'meatloaf',
'eastwood',
'dominion',
'destroyer',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'chipmunk',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'berkeley',
'thinking',
'seminole',
'platypus',
'mephisto',
'lancaster',
'knowledge',
'darklord',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'carnival',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'blowfish',
'sandwich',
'knuckles',
'benedict',
'sprinter',
'moonshine',
'missouri',
'meridian',
'gargoyle',
'disaster',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'complete',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'claymore',
'chainsaw',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'bluebell',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'thunderbird',
'smashing',
'playtime',
'lonestar',
'heritage',
'forsaken',
'challenger',
'backdoor',
'yosemite',
'yogibear',
'talisman',
'syracuse',
'randolph',
'raistlin',
'preacher',
'millions',
'metallic',
'dontknow',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'charisma',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'sinister',
'mcdonald',
'goldeneye',
'frontier',
'flipflop',
'eggplant',
'chrysler',
'buckshot',
'arkansas',
'archangel',
'romantic',
'robotics',
'megatron',
'hyperion',
'hamburger',
'friendly',
'dreaming',
'doghouse',
'christin',
'addicted',
'negative',
'computers',
'chestnut',
'auckland',
'wanderer',
'tomahawk',
'thanatos',
'roderick',
'pentagon',
'millenium',
'mechanic',
'creature',
'cornwall',
'chadwick',
'calendar',
'supervisor',
'revolver',
'railroad',
'minnesota',
'mariners',
'holyshit',
'database',
'bobafett',
'amethyst',
'albatross',
'advanced',
'whistler',
'slamdunk',
'sheffield',
'scrabble',
'roadkill',
'obsidian',
'northern',
'learning',
'independent',
'elements',
'electron',
'customer',
'brisbane',
'baritone',
'armageddon',
'windmill',
'surprise',
'starfire',
'speakers',
'lifetime',
'fredrick',
'fidelity',
'everyday',
'coolness',
'concorde',
'blackhawk',
'traveler',
'potatoes',
'pipeline',
'pathfinder',
'monterey',
'lipstick',
'lakeside',
'fishbone',
'biohazard',
'windsurf',
'velocity',
'vagabond',
'reloaded',
'raindrop',
'prudence',
'peaceful',
'multimedia',
'montgomery',
'marietta',
'ladybird',
'internal',
'gigabyte',
'fourteen',
'chambers',
'bunghole',
'apocalypse',
'aphrodite',
'zerocool',
'wrestler',
'tortoise',
'sysadmin',
'starship',
'primrose',
'politics',
'paranoia',
'overload',
'nevermore',
'melbourne',
'matthews',
'marriage',
'macaroni',
'jonathon',
'infinite',
'heinrich',
'graduate',
'godspeed',
'feedback',
'cornelia',
'corleone',
'choochoo',
'challenge',
'chairman',
'barracuda',
'accounting',
'sleeping',
'quicksilver',
'paradigm',
'nickolas',
'nautilus',
'feathers',
'aviation',
'avalanche',
'wildwood',
'thrasher',
'speedway',
'songbird',
'sickness',
'screamer',
'riverside',
'princeton',
'manhattan',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'ambrosia',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'adrianna',
'spaghetti',
'slapshot',
'ministry',
'lighting',
'helsinki',
'frederik',
'flexible',
'festival',
'daydream',
'coventry',
'constant',
'connection',
'woodland',
'signature',
'rockford',
'merchant',
'greatest',
'everlast',
'espresso',
'elizabet',
'dddddddd',
'community',
'charlton',
'stronger',
'starbuck',
'skeleton',
'scissors',
'reginald',
'redeemer',
'normandy',
'laserjet',
'graffiti',
'doughboy',
'building',
'bbbbbbbb',
'annabell',
'alchemist',
'zimbabwe',
'wisconsin',
'tunafish',
'thisisit',
'stafford',
'spalding',
'sometimes',
'solitude',
'robotech',
'minister',
'leonidas',
'kirkland',
'integral',
'incognito',
'ignatius',
'heavenly',
'gggggggg',
'exchange',
'winfield',
'thriller',
'sausages',
'salamander',
'printing',
'palmtree',
'opendoor',
'mosquito',
'milkyway',
'mcdonalds',
'laughter',
'klondike',
'kingsley',
'invisible',
'humphrey',
'hillside',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'hattrick',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'hammerhead',
'function',
'forgotten',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'fighting',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'excellent',
'delaware',
'darthvader',
'costello',
'catalyst',
'assholes',
'andersen',
'alexande',
'whiplash',
'solutions',
'rockwell',
'reddevil',
'glendale',
'foxylady',
'fortress',
'favorite',
'doughnut',
'comanche',
'cheshire',
'bertrand',
'barefoot',
'arabella',
'alligator',
'vanguard',
'stuttgart',
'rhapsody',
'reckless',
'powerful',
'painting',
'nocturne',
'nickname',
'llllllll',
'leighton',
'kingfisher',
'johnston',
'holidays',
'henderson',
'handyman',
'flamenco',
'escalade',
'division',
'covenant',
'churchill',
'cannibal',
'annmarie',
'alcatraz',
'wwwwwwww',
'wildcard',
'whitesox',
'thornton',
'temporary',
'survival',
'supernatural',
'sprocket',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'somerset',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'services',
'saxophone',
'sacrifice',
'restless',
'pumpkins',
'operation',
'nosferatu',
'meathead',
'licorice',
'language',
'generation',
'flanders',
'edinburgh',
'disciple',
'diplomat',
'crescent',
'counterstrike',
'catholic',
'calculator',
'browning',
'biscuits',
'violator',
'tangerine',
'straight',
'sorcerer',
'sidekick',
'shredder',
'schubert',
'prestige',
'nonsense',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'mulligan',
'matchbox',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'marauder',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'longhair',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'lisalisa',
'islander',
'grasshopper',
'gardenia',
'edmonton',
'downhill',
'cromwell',
'chowchow',
'terrapin',
'tennessee',
'stockton',
'spartacus',
'smoothie',
'seahawks',
'revelation',
'puppydog',
'marigold',
'gregorio',
'goldfinger',
'gangbang',
'daylight',
'constantine',
'clueless',
'calamity',
'beefcake',
'aquarium',
'anathema',
'ambition',
'wildlife',
'undercover',
'snowbird',
'schneider',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'prospect',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'pendragon',
'lockdown',
'jellyfish',
'irishman',
'infamous',
'hydrogen',
'hartford',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'goodyear',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'generals',
'garrison',
'foxhound',
'entrance',
'eighteen',
'dimension',
'daedalus',
'cocktail',
'chameleon',
'caligula',
'borabora',
'behemoth',
'balloons',
'bachelor',
'waterman',
'teenager',
'spanking',
'sergeant',
'seashell',
'seahorse',
'scarecrow',
'riffraff',
'possible',
'pittsburgh',
'pinnacle',
'nostromo',
'latitude',
'invasion',
'hibiscus',
'hallmark',
'firestorm',
'envision',
'charcoal',
'character',
'antelope',
'aircraft',
'unlimited',
'transport',
'stripper',
'snowwhite',
'smirnoff',
'seraphim',
'reporter',
'painkiller',
'nineteen',
'monolith',
'memories',
'memorial',
'massacre',
'goofball',
'engineering',
'doorknob',
'dipstick',
'commerce',
'carousel',
'callisto',
'brilliant',
'berenice',
'barbarian',
'wormwood',
'schumacher',
'rosewood',
'rochester',
'roadster',
'rapunzel',
'prisoner',
'prescott',
'phillies',
'pasadena',
'optimist',
'monkeyboy',
'metropolis',
'kimberley',
'junkmail',
'inspiron',
'hhhhhhhh',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'griffith',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'greenwood',
'golfball',
'forester',
'euphoria',
'cornelius',
'constance',
'conquest',
'clitoris',
'cartoons',
'buckaroo',
'bluejays',
'volunteer',
'violence',
'terrence',
'temporal',
'teamwork',
'shipping',
'serendipity',
'roosters',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'prophecy',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'playmate',
'panorama',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'landmark',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'instinct',
'infected',
'illuminati',
'honeydew',
'foundation',
'forbidden',
'document',
'deadline',
'crocodile',
'climbing',
'bluestar',
'birmingham',
'bathroom',
'baltimore',
'whiteboy',
'trinitron',
'titleist',
'tiberius',
'superhero',
'sidewinder',
'rosemarie',
'retarded',
'peppermint',
'palomino',
'outsider',
'oooooooo',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'musician',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'michelin',
'juggernaut',
'hyacinth',
'gatorade',
'fuzzball',
'everyone',
'dictionary',
'development',
'delirium',
'critical',
'cordelia',
'collection',
'capitals',
'bobdylan',
'birdhouse',
'asparagus',
'voltaire',
'submarine',
'stonewall',
'southpaw',
'sanctuary',
'ruthless',
'reaction',
'qazwsxed',
'prometheus',
'portable',
'passcode',
'official',
'neverland',
'mindless',
'masamune',
'legendary',
'incredible',
'holloway',
'heartless',
'hairball',
'genevieve',
'fireworks',
'dilligaf',
'crossfire',
'clippers',
'caldwell',
'waterpolo',
'vertical',
'timeless',
'thegreat',
'superuser',
'spelling',
'slippery',
'rrrrrrrr',
'ricochet',
'redemption',
'raspberry',
'protocol',
'producer',
'patterson',
'olivetti',
'metalica',
'mannheim',
'mandingo',
'magellan',
'machines',
'lovebird',
'inflames',
'important',
'headache',
'gemstone',
'ffffffff',
'cyclones',
'colonial',
'claudius',
'bulgaria',
'brunette',
'bradshaw',
'bastards',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'basement',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'applesauce',
'acapulco',
'yingyang',
'workshop',
'trueblue',
'transformers',
'tarantula',
'sycamore',
'stigmata',
'stargazer',
'override',
'nighthawk',
'mortgage',
'macdaddy',
'leicester',
'knockers',
'jjjjjjjj',
'hysteria',
'forgiven',
'distance',
'destruction',
'cosworth',
'coconuts',
'carlisle',
'breakfast',
'antivirus',
'yokohama',
'unforgiven',
'surrender',
'sheepdog',
'seinfeld',
'sabotage',
'reddragon',
'pressure',
'pinetree',
'pavement',
'oriental',
'offshore',
'newzealand',
'netscape',
'michaels',
'junkyard',
'jakejake',
'invincible',
'hawthorn',
'hawaiian',
'greyhound',
'frenchie',
'fastball',
'deathrow',
'carpenter',
'breakout',
'bismarck',
'alkaline',
'adrenalin',
'tryagain',
'thatcher',
'stampede',
'shakespeare',
'scheisse',
'sayonara',
'santacruz',
'passions',
'notorious',
'necromancer',
'nameless',
'mysterio',
'millennium',
'megabyte',
'mccarthy',
'magister',
'madhouse',
'liverpoo',
'leviathan',
'jennings',
'holstein',
'hellraiser',
'freefall',
'flawless',
'emergency',
'ebenezer',
'divinity',
'chewbacca',
'chastity',
'charlott',
'buchanan',
'aventura',
'zildjian',
'wargames',
'vvvvvvvv',
'unicorns',
'timberland',
'tasmania',
'symphony',
'splendid',
'sonyvaio',
'snapshot',
'saunders',
'reverend',
'prototype',
'polaroid',
'perfecto',
'mystical',
'material',
'maddison',
'landlord',
'juvenile',
'goodwill',
'goldwing',
'gilberto',
'flapjack',
'finnegan',
'erection',
'clemente',
'caterpillar',
'capetown',
'accounts',
'abstract',
'townsend',
'technical',
'smithers',
'shooting',
'shitshit',
'senators',
'sacramento',
'redbaron',
'programmer',
'percival',
'painless',
'northstar',
'newspaper',
'mongolia',
'miroslav',
'lumberjack',
'lakewood',
'incoming',
'immanuel',
'hometown',
'homeless',
'hillbilly',
'goodnight',
'giordano',
'genocide',
'enforcer',
'dreamcast',
'dispatch',
'developer',
'copenhagen',
'codename',
'clockwork',
'cccccccc',
'callaway',
'calculus',
'bartender',
'attorney',
'asteroid',
'angeleyes',
'academia',
'warehouse',
'terrance',
'stirling',
'stamford',
'stairway',
'specialist',
'soldiers',
'shitface',
'rotterdam',
'pizzahut',
'pepperoni',
'patricio',
'passwerd',
'mulberry',
'luscious',
'lifeline',
'legoland',
'kickflip',
'kennwort',
'kathrine',
'johnathan',
'excelsior',
'drummond',
'disneyland',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'delldell',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'claudine',
'christia',
'checkmate',
'centurion',
'cashmere',
'carthage',
'bartlett',
'animation',
'alphonse',
'woodside',
'vengeance',
'vaseline',
'toxicity',
'tommyboy',
'ticktock',
'teachers',
'strategy',
'stephens',
'snowdrop',
'smeghead',
'shutdown',
'sexysexy',
'pretender',
'popsicle',
'philadelphia',
'petersen',
'moonstone',
'masterkey',
'maryanne',
'magicman',
'identity',
'hannover',
'glorious',
'gathering',
'forgetit',
'fishtank',
'fernandes',
'epiphone',
'elevator',
'elegance',
'drumline',
'devilman',
'delivery',
'chrissie',
'carnaval',
'caffeine',
'bukowski',
'brownies',
'bearcats',
'woofwoof',
'untitled',
'tttttttt',
'stickman',
'starlite',
'southwest',
'smarties',
'penthouse',
'peanutbutter',
'oxymoron',
'oleander',
'nightfall',
'newjersey',
'muhammed',
'morphine',
'mobydick',
'meltdown',
'medieval',
'mahogany',
'longshot',
'lockheed',
'livewire',
'lakeland',
'kenworth',
'interpol',
'integrity',
'hibernia',
'helpdesk',
'fishhead',
'everybody',
'ethernet',
'elemental',
'duracell',
'delicious',
'crystals',
'confidence',
'colossus',
'belladonna',
'backlash',
'academic',
'abnormal',
'vineyard',
'terrible',
'suburban',
'stocking',
'springfield',
'snuffles',
'sideways',
'sensation',
'schwartz',
'salasana',
'rosalind',
'radiation',
'purchase',
'protection',
'practice',
'poiuytre',
'piramide',
'nashville',
'montrose',
'lunchbox',
'lonesome',
'limerick',
'imagination',
'ignition',
'homebrew',
'helicopter',
'greenman',
'firefire',
'electronic',
'economics',
'contract',
'conflict',
'comeback',
'cheeseburger',
'believer',
'beaumont',
'arrowhead',
'alternative',
'woodward',
'wolverin',
'wellness',
'timberlake',
'terrorist',
'temptation',
'swingers',
'solstice',
'scratchy',
'roosevelt',
'rockport',
'redlight',
'perfection',
'paulette',
'overtime',
'nazareth',
'mudvayne',
'movement',
'miracles',
'maserati',
'marbella',
'lifestyle',
'kiwikiwi',
'jurassic',
'infernal',
'hereford',
'goodtime',
'gamecock',
'galadriel',
'gabriell',
'firefighter',
'ferreira',
'ethiopia',
'dionysus',
'different',
'deadpool',
'crossroads',
'christos',
'chauncey',
'castaway',
'carefree',
'burnside',
'boomerang',
'bohemian',
'blackice',
'blackhole',
'bigmouth',
'baptiste',
'augustin',
'arlington',
'ambassador',
'alistair',
'agamemnon',
'advocate',
'acoustic',
'zimmerman',
'yorkshire',
'wallpaper',
'vinicius',
'vauxhall',
'understand',
'terminus',
'surround',
'stronghold',
'sessions',
'scirocco',
'schiller',
'schedule',
'regional',
'radiance',
'pioneers',
'phantasy',
'obsession',
'neutrino',
'mountains',
'marmalade',
'kendrick',
'heinlein',
'gillette',
'germania',
'fruitcake',
'fighters',
'fastback',
'exercise',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'envelope',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'eeeeeeee',
'diabetes',
'destination',
'davenport',
'damascus',
'coronado',
'chevalier',
'cashflow',
'cardigan',
'boyfriend',
'blueprint',
'blackboy',
'bitchass',
'backpack',
'aquamarine',
'anakonda',
'Victoria',
'911turbo',
'worldwide',
'viscount',
'violette',
'undertow',
'traveller',
'transformer',
'tombstone',
'surfboard',
'stratocaster',
'stephani',
'stainless',
'scorpions',
'redstone',
'premiere',
'planning',
'peacemaker',
'numberone',
'nitrogen',
'natascha',
'moonwalk',
'marzipan',
'mandolin',
'maintain',
'macgyver',
'lexington',
'landscape',
'killkill',
'jailbird',
'goodnews',
'gatekeeper',
'freshman',
'frankfurt',
'frankenstein',
'firestar',
'dreamland',
'discreet',
'detective',
'crossbow',
'choppers',
'betrayed',
'bernhard',
'basilisk',
'armadillo',
'antigone',
'alterego',
'alhambra',
'aerobics',
'advantage',
'Superman',
'yyyyyyyy',
'yellowstone',
'woodruff',
'sunnyboy',
'specialk',
'sorrento',
'reliance',
'proverbs',
'policeman',
'playgirl',
'pentium4',
'pedigree',
'partners',
'overdrive',
'observer',
'nnnnnnnn',
'newworld',
'moriarty',
'minotaur',
'location',
'knockout',
'knickers',
'kassandra',
'hellyeah',
'greentea',
'goodgood',
'gasoline',
'flashman',
'firestarter',
'fatality',
'ellipsis',
'disorder',
'deadlock',
'davidoff',
'couscous',
'construction',
'congress',
'cleaning',
'clarkson',
'christoph',
'cheerleader',
'ceramics',
'casandra',
'cambodia',
'blackstar',
'ballerina',
'backbone',
'whatwhat',
'westcoast',
'watching',
'underwear',
'tomatoes',
'tiramisu',
'tiberian',
'thurston',
'spinning',
'slippers',
'response',
'reindeer',
'prosperity',
'panchito',
'nottingham',
'mythology',
'mayfield',
'marquise',
'manifest',
'magnetic',
'lovelace',
'lesbians',
'joystick',
'inspector',
'industry',
'gulliver',
'ganymede',
'galactic',
'furniture',
'flashback',
'esoteric',
'dropdead',
'drinking',
'devildog',
'copeland',
'christop',
'cheerios',
'chatting',
'chantelle',
'changeit',
'cerulean',
'cabernet',
'blackheart',
'baltazar',
'alpha123',
'alleycat',
'accident',
'trickster',
'tingting',
'thething',
'tallulah',
'symmetry',
'stonehenge',
'smartass',
'shortcake',
'salesman',
'rushmore',
'resource',
'pregnant',
'pleasant',
'playground',
'plankton',
'pendulum',
'paterson',
'partizan',
'olympics',
'northwest',
'networks',
'nederland',
'mystique',
'mckinley',
'mcgregor',
'maxpower',
'mathematics',
'lafayette',
'kokakola',
'katherin',
'julianna',
'jeannine',
'horseman',
'homeland',
'hennessy',
'guesswho',
'greywolf',
'gilligan',
'gallardo',
'freewill',
'fleetwood',
'fantomas',
'eightball',
'dutchman',
'dementia',
'breakdown',
'berliner',
'adrenaline',
'woodwork',
'winifred',
'waterboy',
'troopers',
'theodora',
'sometime',
'sagittarius',
'rocketman',
'roadking',
'rifleman',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'pizzaman',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'phantasm',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'pathetic',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'parliament',
'oldschool',
'nicotine',
'nefertiti',
'minstrel',
'milwaukee',
'millionaire',
'kindness',
'insurance',
'independence',
'hatfield',
'freelance',
'forsythe',
'fontaine',
'feelgood',
'experience',
'evidence',
'erickson',
'enter123',
'energizer',
'downfall',
'deadwood',
'dandelion',
'crazyman',
'corporate',
'commandos',
'citation',
'chinchilla',
'champions',
'calliope',
'broccoli',
'bleeding',
'berserker',
'bergkamp',
'backstreet',
'asmodeus',
'artistic',
'antilles',
'anteater',
'Jonathan',
'wrinkles',
'triplets',
'telecaster',
'sunnyday',
'students',
'stockholm',
'starshine',
'sopranos',
'siberian',
'shetland',
'sheppard',
'scrapper',
'schooner',
'rebellion',
'pershing',
'parasite',
'palmetto',
'overture',
'odysseus',
'notredame',
'narayana',
'nakamura',
'mushrooms',
'moderator',
'metalgear',
'mediator',
'mcintosh',
'mayflower',
'marykate',
'manpower',
'malamute',
'louisiana',
'kryptonite',
'jeronimo',
'jeremias',
'jamaican',
'imperium',
'hurricanes',
'humberto',
'hoosiers',
'goldmine',
'futurama',
'elisabet',
'earthquake',
'dumpling',
'dragster',
'dominica',
'dominate',
'dictator',
'desperate',
'cookbook',
'confusion',
'concerto',
'christel',
'blacksmith',
'beholder',
'babushka',
'autobahn',
'attention',
'atmosphere',
'anywhere',
'aftermath',
'acidburn',
'whiteout',
'typewriter',
'thousand',
'thorsten',
'thematrix',
'symantec',
'splatter',
'sonysony',
'slaughter',
'sensitive',
'schaefer',
'reddwarf',
'providence',
'position',
'popopopo',
'pikapika',
'piercing',
'performance',
'paramedic',
'pakistani',
'neighbor',
'motorcycle',
'mireille',
'lovesick',
'loverman',
'lockwood',
'lifeguard',
'kowalski',
'kerberos',
'kellyann',
'jayhawks',
'innuendo',
'iiiiiiii',
'hummingbird',
'horrible',
'himalaya',
'highlife',
'hetfield',
'heartbeat',
'guitarist',
'graphite',
'funnyman',
'epiphany',
'elvis123',
'discount',
'copyright',
'concordia',
'complicated',
'clementine',
'chouette',
'chinchin',
'chinatown',
'chinaman',
'chesterfield',
'cervantes',
'celestial',
'calderon',
'bullhead',
'brussels',
'broadband',
'brasilia',
'bellevue',
'bagpipes',
'aurelius',
'aristotle',
'altitude',
'aloysius',
'affinity',
'09876543',
'winnipeg',
'ultraman',
'treefrog',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'tigercat',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'taratara',
'tactical',
'system32',
'swastika',
'searcher',
'reserved',
'redbeard',
'realtime',
'pyramids',
'provider',
'projects',
'production',
'poontang',
'pinecone',
'pericles',
'pennywise',
'paradiso',
'parachute',
'parabola',
'palestine',
'overflow',
'motorbike',
'mavericks',
'marybeth',
'marriott',
'madalena',
'loophole',
'lonsdale',
'lingerie',
'ledzeppelin',
'lavalamp',
'joselito',
'jerrylee',
'jamboree',
'interest',
'hugoboss',
'heythere',
'hehehehe',
'hangover',
'greatone',
'gardener',
'exorcist',
'dressage',
'dominator',
'domination',
'dodgeram',
'cummings',
'commodore',
'christen',
'callahan',
'calcutta',
'burberry',
'bulletproof',
'bombshell',
'blackburn',
'betrayal',
'atkinson',
'athletic',
'arachnid',
'amaranth',
'algernon',
'alastair',
'absinthe',
'zoomzoom',
'wonderboy',
'whatthefuck',
'watchman',
'transform',
'trampoline',
'tortilla',
'thunderbolt',
'superduper',
'squadron',
'skylight',
'sanfrancisco',
'salamandra',
'resistance',
'reliable',
'recorder',
'provence',
'porsche9',
'piedmont',
'pentagram',
'overdose',
'nightman',
'nightingale',
'monument',
'longtime',
'lolololo',
'lokiloki',
'laughing',
'kerrigan',
'jeopardy',
'inspiration',
'ibelieve',
'houghton',
'horsemen',
'hologram',
'hideaway',
'handicap',
'hamsters',
'forklift',
'finished',
'dorothea',
'devotion',
'deathstar',
'darkknight',
'conchita',
'classics',
'bridgette',
'bigballs',
'barnyard',
'baphomet',
'badlands',
'asterisk',
'arcangel',
'antoinette',
'annemarie',
'Christian',
'whoknows',
'trousers',
'treehouse',
'tranquil',
'toriamos',
'teardrop',
'superboy',
'shortcut',
'shockwave',
'shocking',
'scranton',
'sandoval',
'roseanne',
'red12345',
'prospero',
'products',
'paperclip',
'outdoors',
'nemesis1',
'nagasaki',
'mousepad',
'morrissey',
'monkeyman',
'modeling',
'maranatha',
'makeitso',
'maelstrom',
'limpbizkit',
'lightbulb',
'lalakers',
'katharina',
'kakaroto',
'jeannette',
'investor',
'insecure',
'humanoid',
'holiness',
'helpless',
'hallelujah',
'greenhouse',
'germaine',
'gallagher',
'freefree',
'francais',
'firestone',
'firebolt',
'filipino',
'falstaff',
'electronics',
'economist',
'dominant',
'diabolic',
'deadbeat',
'crockett',
'crazycat',
'composer',
'coleslaw',
'cincinnati',
'cascades',
'breaking',
'bluenose',
'bluegrass',
'bisexual',
'billions',
'billbill',
'bigbrother',
'avengers',
'athletics',
'assembly',
'asasasas',
'allstars',
'alakazam',
'activate',
'Computer',
'zerozero',
'windowsxp',
'vigilant',
'verygood',
'trustnoone',
'truffles',
'toothpaste',
'tigerman',
'sweetwater',
'summoner',
'suicidal',
'strummer',
'stiletto',
'squeaker',
'sixtynine',
'sithlord',
'siegfried',
'showcase',
'serenade',
'sepultura',
'rotation',
'rockhard',
'quintana',
'pepsicola',
'passenger',
'pacifica',
'nightshade',
'newhouse',
'muenchen',
'motorhead',
'morrigan',
'memememe',
'maximize',
'marciano',
'macdonald',
'loveable',
'lakeview',
'hyderabad',
'historia',
'highschool',
'hiawatha',
'hermitage',
'goodtimes',
'freeport',
'flathead',
'faulkner',
'endymion',
'emirates',
'dreamers',
'district',
'dietrich',
'cranberry',
'cockroach',
'clemence',
'classified',
'cellular',
'catherin',
'carmella',
'burgundy',
'blooming',
'blitzkrieg',
'bladerunner',
'bigboobs',
'beachbum',
'backyard',
'backward',
'babybear',
'argonaut',
'appleton',
'aguilera',
'abundance',
'Nicholas',
'zaragoza',
'woodcock',
'wisteria',
'westlake',
'untouchable',
'trapdoor',
'tigereye',
'thetruth',
'testicle',
'superbowl',
'sprinkle',
'snakebite',
'silencer',
'secretary',
'scottish',
'sanderson',
'sanandreas',
'robertson',
'richelle',
'richardson',
'religion',
'quiksilver',
'queenbee',
'psychology',
'playhouse',
'physical',
'pensacola',
'pedersen',
'paperboy',
'pandemonium',
'nikolaus',
'murderer',
'montague',
'mockingbird',
'mercutio',
'mercurio',
'mcknight',
'maxpayne',
'mandragora',
'mamacita',
'madhatter',
'lucretia',
'kusanagi',
'knoxville',
'katmandu',
'julianne',
'jiujitsu',
'jeanpaul',
'infrared',
'industrial',
'humanity',
'hotwheels',
'honeypot',
'honeybun',
'herkules',
'heartbreaker',
'hawkeyes',
'gilgamesh',
'geometry',
'friedman',
'freiheit',
'firework',
'federation',
'executive',
'exclusive',
'excellence',
'emotional',
'elbereth',
'dragon99',
'dollface',
'devilish',
'democrat',
'darkmoon',
'crackpot',
'costarica',
'costanza',
'consuelo',
'clarisse',
'citibank',
'cingular',
'chrystal',
'channing',
'carvalho',
'bluebear',
'billyjoe',
'benedikt',
'beaufort',
'barnabas',
'baracuda',
'augustine',
'armitage',
'alcapone',
'afterlife',
'adrianne',
'Internet',
'Football',
'yourself',
'yorktown',
'yeahyeah',
'wildflower',
'valdemar',
'unlocked',
'unleashed',
'twinkles',
'trujillo',
'torrents',
'tonyhawk',
'tanzania',
'takedown',
'takamine',
'supercool',
'subwoofer',
'stitches',
'standing',
'stalingrad',
'srilanka',
'sparhawk',
'slowpoke',
'shoelace',
'service1',
'senorita',
'seashore',
'sandstorm',
'roulette',
'radiator',
'problems',
'powerhouse',
'postmaster',
'platform',
'parallax',
'nepenthe',
'moonmoon',
'livingston',
'labyrinth',
'jackhammer',
'intrigue',
'interface',
'interact',
'honeymoon',
'grapefruit',
'government',
'geography',
'galloway',
'fullback',
'fuckhead',
'fairview',
'divorced',
'disabled',
'defiance',
'deeznutz',
'communication',
'cocksucker',
'cheating',
'buckwheat',
'boarding',
'blackdragon',
'baseline',
'bandicoot',
'baldrick',
'apollo11',
'ambulance',
'aluminum',
'abercrombie',
'woodwind',
'woodpecker',
'woodbury',
'watchdog',
'tribunal',
'toreador',
'tigerwoods',
'thinkpad',
'thebeach',
'test12345',
'terrific',
'teaching',
'successful',
'stringer',
'sovereign',
'souvenir',
'sombrero',
'shuriken',
'shotokan',
'shinichi',
'scooters',
'schroeder',
'schnitzel',
'rosalinda',
'regiment',
'rainfall',
'pistache',
'pianoman',
'paddington',
'overseas',
'orthodox',
'nietzsche',
'monorail',
'minemine',
'milhouse',
'mermaids',
'mansfield',
'madrigal',
'krakatoa',
'junction',
'intranet',
'imperator',
'humility',
'harmless',
'giuliana',
'gauntlet',
'fugitive',
'flatland',
'feelings',
'entertainment',
'election',
'dumpster',
'cruzeiro',
'cracking',
'cheaters',
'centrino',
'canberra',
'botswana',
'blockbuster',
'blahblahblah',
'blackfire',
'blackbelt',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'atreides',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'asuncion',
'astronomy',
'astroboy',
'aqualung',
'amnesiac',
'adorable',
'3edc4rfv',
'worldcup',
'wholesale',
'vittorio',
'underwood',
'underwater',
'touchdown',
'theworld',
'thebeast',
'thaddeus',
'telemark',
'sylvania',
'surveyor',
'suitcase',
'stroller',
'stripped',
'stratford',
'stallone',
'speedster',
'septembe',
'sandberg',
'rousseau',
'revenant',
'protector',
'protected',
'pembroke',
'parkside',
'outbreak',
'obsolete',
'nutshell',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'nonenone',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'multisync',
'momentum',
'microwave',
'marguerite',
'maldives',
'magdalen',
'longbeach',
'lockhart',
'kensington',
'humboldt',
'homebase',
'headshot',
'headless',
'hazelnut',
'gremlins',
'fireblade',
'external',
'entering',
'electrical',
'dulcinea',
'dropkick',
'draconis',
'domestic',
'daydreamer',
'darkwing',
'corporal',
'cocorico',
'chimaera',
'cheyanne',
'celebrate',
'caballero',
'breakers',
'brainstorm',
'bluesman',
'blackpool',
'bethesda',
'basketba',
'antichrist',
'andyandy',
'abcdefghi',
'Garfield',
'yoyoyoyo',
'yeahbaby',
'wetpussy',
'vergessen',
'variable',
'trillium',
'torrance',
'tikitiki',
'thesaint',
'theforce',
'succubus',
'stockman',
'steve123',
'speeding',
'solitaire',
'sokrates',
'slingshot',
'skateboarding',
'silverfox',
'showboat',
'sequence',
'rottweiler',
'rincewind',
'rainmaker',
'postcard',
'polkadot',
'photoshop',
'persimmon',
'pandabear',
'nutrition',
'nicknick',
'mysterious',
'marielle',
'maneater',
'lionlion',
'leningrad',
'leapfrog',
'kristopher',
'kirkwood',
'kilkenny',
'jediknight',
'jabberwocky',
'intercom',
'informix',
'hounddog',
'homicide',
'herschel',
'henrietta',
'hatteras',
'harakiri',
'halfmoon',
'gunslinger',
'fivestar',
'firewood',
'expedition',
'executor',
'elcamino',
'egyptian',
'duckling',
'drumming',
'drifting',
'daisydog',
'contrast',
'collector',
'choclate',
'chilling',
'channels',
'catapult',
'careless',
'californ',
'brunswick',
'braindead',
'bluedragon',
'bloodline',
'beverley',
'atalanta',
'antihero',
'allright',
'43214321',
'18436572',
'woodlands',
'wilkinson',
'wellcome',
'waldemar',
'valerian',
'tornado1',
'thunders',
'testament',
'tennyson',
'tarragon',
'tapestry',
'tajmahal',
'struggle',
'starling',
'starchild',
'sobriety',
'snowfall',
'shalimar',
'settings',
'schnecke',
'satriani',
'sailfish',
'roserose',
'reference',
'powerman',
'powerade',
'playstation2',
'plastics',
'pinkpink',
'parallel',
'papercut',
'p4ssword',
'navyseal',
'monopoli',
'mnemonic',
'millenia',
'mercenary',
'membrane',
'manitoba',
'limelight',
'leopards',
'kurdistan',
'karoline',
'johnpaul',
'interior',
'interesting',
'insomniac',
'homepage',
'heavymetal',
'headhunter',
'harvester',
'greeting',
'golfgolf',
'glassman',
'gladstone',
'friction',
'ethereal',
'emotions',
'dudedude',
'douglass',
'desperados',
'demetrio',
'demented',
'decision',
'cuthbert',
'compound',
'comatose',
'civilwar',
'charleston',
'castello',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'bulletin',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'brandnew',
'bluegill',
'bloodhound',
'baywatch',
'bastardo',
'bagheera',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'allstate',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'aldebaran',
'Samantha',
'Elizabeth',
'78945612',
'wolverines',
'wolfhound',
'wildbill',
'whittier',
'virgilio',
'vegetable',
'unbreakable',
'trusting',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'troubles',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'tonytony',
'terriers',
'template',
'telefoon',
'talented',
'superpower',
'supermen',
'sugarplum',
'starting',
'sixpence',
'simplicity',
'sidewalk',
'shoshana',
'sasquatch',
'rattlesnake',
'rafferty',
'qwerty00',
'promotion',
'pinocchio',
'philosophy',
'philippines',
'pheasant',
'pentium3',
'overlook',
'overhead',
'operations',
'okokokok',
'nwo4life',
'nostradamus',
'newdelhi',
'myfriend',
'munchies',
'mountaindew',
'moneybag',
'molecule',
'melville',
'mcintyre',
'mattress',
'marshmallow',
'maritime',
'mariachi',
'lovesong',
'lolalola',
'lifeboat',
'kasandra',
'kalamazoo',
'jackrabbit',
'intelligent',
'innocence',
'henry123',
'henrique',
'hardball',
'handbook',
'hacienda',
'grenoble',
'goodmorning',
'giuliano',
'frostbite',
'freehand',
'fragment',
'foreskin',
'explosion',
'experiment',
'ensemble',
'eclectic',
'dogfight',
'diogenes',
'dillweed',
'dickinson',
'demetrius',
'daybreak',
'dagobert',
'culinary',
'crossing',
'controls',
'consulting',
'cobblers',
'chatterbox',
'charissa',
'celebrity',
'bungalow',
'broadcast',
'bodyguard',
'ballroom',
'analysis',
'afghanistan',
'addiction',
'12131213',
'witchcraft',
'wertwert',
'vivienne',
'vermilion',
'ultrasound',
'tuppence',
'tropicana',
'trafford',
'streamer',
'starburst',
'ssssssssss',
'spotlight',
'specialized',
'sparrows',
'sideshow',
'sherbert',
'seminoles',
'sebastia',
'scribble',
'sarasota',
'sarasara',
'sanguine',
'reflection',
'redhorse',
'rational',
'radioman',
'progressive',
'poophead',
'plutonium',
'phantoms',
'organize',
'optiplex',
'neverdie',
'nantucket',
'monsieur',
'monkfish',
'mauritius',
'master01',
'marymary',
'marvelous',
'manifesto',
'macedonia',
'logistic',
'leprechaun',
'lemmings',
'langston',
'innovation',
'house123',
'hihihihi',
'hellhole',
'hardwood',
'generator',
'funhouse',
'fullhouse',
'flowerpower',
'fiorella',
'farewell',
'fantasma',
'faithless',
'failsafe',
'explicit',
'esposito',
'enchanted',
'duckduck',
'drilling',
'dragon10',
'doodlebug',
'dickweed',
'crunchie',
'crawfish',
'condition',
'chessman',
'chanelle',
'chamonix',
'celebration',
'brotherhood',
'brainiac',
'bluewater',
'birdland',
'binladen',
'billings',
'bareback',
'bacteria',
'authority',
'astronaut',
'asdfqwer',
'arpeggio',
'appleseed',
'animator',
'amazonas',
'alpacino',
'adelaida',
'adamadam',
'Einstein',
'90909090',
'yamamoto',
'wormhole',
'windows98',
'whiteman',
'westgate',
'watchmen',
'vergeten',
'veracruz',
'vanquish',
'uuuuuuuu',
'undefined',
'trucking',
'tormentor',
'timelord',
'timberwolf',
'strangle',
'stoneman',
'starless',
'spiritual',
'spagetti',
'sorensen',
'somethin',
'snowhite',
'slovakia',
'skydiver',
'silvester',
'silicone',
'silencio',
'shevchenko',
'selector',
'scramble',
'scott123',
'salinger',
'rendezvous',
'reminder',
'redheads',
'propaganda',
'presidente',
'pocahontas',
'photography',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'phaedrus',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'permanent',
'paulchen',
'paraguay',
'palacios',
'osbourne',
'mutation',
'murakami',
'mercator',
'manticore',
'lynnette',
'lookatme',
'lightnin',
'lifeless',
'leopoldo',
'knitting',
'killerbee',
'interactive',
'hellhound',
'happening',
'gridlock',
'greatness',
'gigantic',
'fred1234',
'flatline',
'firehouse',
'firehawk',
'fellatio',
'eruption',
'encounter',
'delorean',
'decipher',
'darkblue',
'creatine',
'counting',
'cornbread',
'coolidge',
'converge',
'clubbing',
'charmaine',
'cbr600rr',
'carnegie',
'caribbean',
'calabria',
'buttfuck',
'butterflies',
'blueball',
'beautifu',
'barnacle',
'barbarossa',
'automatic',
'asturias',
'armchair',
'archives',
'aperture',
'12141214',
'yourname',
'whitewolf',
'visionary',
'versailles',
'toothpick',
'testuser',
'swordfis',
'superdog',
'sunflowers',
'sunflowe',
'stevenson',
'sportsman',
'somewhere',
'slovenia',
'sinfonia',
'silverfish',
'scimitar',
'rosebush',
'resonance',
'resolution',
'registration',
'redriver',
'redeemed',
'ramstein',
'qweasdzx',
'primetime',
'precision',
'plumbing',
'pickwick',
'parsifal',
'paramount',
'overcome',
'nutcracker',
'ninjutsu',
'newcomer',
'minority',
'mariette',
'loveland',
'localhost',
'leadership',
'lagrange',
'kaitlynn',
'john1234',
'invictus',
'inventor',
'inspired',
'hurrican',
'holbrook',
'hiroshima',
'heracles',
'hawthorne',
'hathaway',
'governor',
'goodrich',
'fortytwo',
'foreplay',
'foolproof',
'fishhook',
'fishfish',
'financial',
'fillmore',
'evangeline',
'espinoza',
'electricity',
'edgewood',
'duisburg',
'drummers',
'dowjones',
'continental',
'cameroon',
'bracelet',
'bogeyman',
'bluerose',
'birdcage',
'billgates',
'beepbeep',
'architecture',
'antonina',
'anabolic',
'allister',
'albacore',
'airedale',
'activity',
'Patricia',
'99887766',
'yardbird',
'xcountry',
'wildrose',
'watanabe',
'wareagle',
'wanderlust',
'wakefield',
'validate',
'tripping',
'treetree',
'timbuktu',
'tarantino',
'syndicate',
'summer00',
'stuntman',
'steelman',
'spaceship',
'snowshoe',
'smuggler',
'slowhand',
'sharpshooter',
'schuster',
'satelite',
'rightnow',
'r4e3w2q1',
'quagmire',
'portsmouth',
'porridge',
'pinkerton',
'peerless',
'paganini',
'orchestra',
'optional',
'nowayout',
'nicaragua',
'neworder',
'michelangelo',
'mcmillan',
'lombardo',
'lindberg',
'larkspur',
'lambchop',
'kirakira',
'kamehameha',
'jellybeans',
'innovision',
'infinito',
'identify',
'hellomoto',
'hellgate',
'heatwave',
'harlequin',
'grounded',
'greenish',
'grandmother',
'gorillaz',
'goldsmith',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'gerhardt',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'generous',
'gauthier',
'frontera',
'freezing',
'fracture',
'firewater',
'fellowship',
'fastlane',
'explosive',
'environment',
'drafting',
'donnelly',
'dolomite',
'direction',
'deception',
'damocles',
'cunningham',
'crossroad',
'critters',
'crickets',
'crabtree',
'cortland',
'constantin',
'connected',
'confidential',
'comrades',
'clothing',
'classical',
'checking',
'cathleen',
'carter15',
'carleton',
'butterscotch',
'butterball',
'bulldozer',
'bomberman',
'blueline',
'bittersweet',
'bigblack',
'backspin',
'babababa',
'audition',
'argentum',
'antonius',
'antiques',
'angelfish',
'americana',
'aluminium',
'woodlawn',
'woodchuck',
'windward',
'warranty',
'visitors',
'vanderbilt',
'turquoise',
'triathlon',
'trespass',
'trashcan',
'topnotch',
'switzerland',
'sturgeon',
'studioworks',
'strikers',
'skipjack',
'simulator',
'silverman',
'shipyard',
'shekinah',
'scouting',
'sanpedro',
'sandrock',
'rootroot',
'reynaldo',
'renaissance',
'rembrandt',
'relentless',
'relative',
'radagast',
'qwertzui',
'presidio',
'presence',
'prentice',
'porcupine',
'playback',
'philippa',
'peterman',
'peregrin',
'peaceman',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'papabear',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'organist',
'octavian',
'northside',
'nightwing',
'nathanael',
'multipass',
'monteiro',
'millhouse',
'metaphor',
'manifold',
'makelove',
'lysander',
'louisville',
'logistics',
'lobsters',
'lifesaver',
'kristofer',
'kilimanjaro',
'julie123',
'johngalt',
'jalapeno',
'jacobsen',
'islanders',
'isengard',
'hutchins',
'horizons',
'hitchcock',
'hemingway',
'heartland',
'hawkwind',
'happyboy',
'gwendolyn',
'gutentag',
'graveyard',
'gracious',
'glenwood',
'frogfrog',
'freelancer',
'fraction',
'forgetful',
'foreigner',
'folklore',
'firetruck',
'fahrenheit',
'express1',
'exposure',
'endurance',
'employee',
'economic',
'ducksoup',
'dragonslayer',
'doggystyle',
'diskette',
'descartes',
'delacruz',
'dashboard',
'damnation',
'creepers',
'copperhead',
'clements',
'cheerful',
'characters',
'certified',
'cathedral',
'catering',
'capucine',
'capacity',
'bridgett',
'breakaway',
'boyscout',
'bloodlust',
'blackstone',
'bingo123',
'belgrade',
'beginner',
'bavarian',
'backfire',
'astaroth',
'arsehole',
'annelise',
'anabelle',
'albright',
'airlines',
'adminadmin',
'adelante',
'Maverick',
'wretched',
'winthrop',
'whirlwind',
'westwind',
'weinberg',
'tumbleweed',
'trashman',
'threesome',
'thibault',
'syndrome',
'swinging',
'sweetiepie',
'sweetest',
'superwoman',
'sunburst',
'sperling',
'spectral',
'silmaril',
'shoulder',
'shahrukh',
'settlers',
'seduction',
'searching',
'scotsman',
'scofield',
'schumann',
'satisfaction',
'santamaria',
'rossignol',
'rodrigues',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
'rockrock',
Update common passwords blacklist I did the update following instructions from this commit: https://github.com/alphagov/notifications-admin/ commit/136662bd309d986a9b7c3e0ee76588612c1ab761 Password repositiories I used were: darkweb2017-top10000.txt probable-v2-top12000.txt twitter-banned.txt
2019-02-15 12:59:23 +00:00
'rockland',
'retriever',
'resurrection',
'restaurant',
'promises',
'priscila',
'priority',
'principal',
'playoffs',
'persephone',
'peregrine',
'overseer',
'opposite',
'oldsmobile',
'octavius',
'nikenike',
'nightcrawler',
'nehemiah',
'morticia',
'morrowind',
'moonraker',
'mithrandir',
'misty123',
'milenium',
'microphone',
'matrix123',
'lollollol',
'lausanne',
'kokokoko',
'kilowatt',
'interval',
'ignorant',
'huntsman',
'hooligans',
'homesick',
'hobgoblin',
'highlands',
'highbury',
'hellbent',
'guerilla',
'graywolf',
'grandson',
'georgetown',
'gentleman',
'gargamel',
'gangsters',
'gameplay',
'flowerpot',
'fielding',
'familiar',
'falconer',
'ezequiel',
'dynamics',
'dominican',
'demolition',
'demetria',
'darkroom',
'curtains',
'currency',
'crocodil',
'creativity',
'crawling',
'commercial',
'cigarette',
'chivalry',
'celestine',
'catriona',
'cassiopeia',
'carolann',
'cannonball',
'canfield',
'buttocks',
'brinkley',
'bordello',
'blissful',
'blackwell',
'blackbox',
'billiard',
'bigbooty',
'belvedere',
'bastille',
'barbershop',
'background',
'australian',
'astalavista',
'assassins',
'artofwar',
'artichoke',
'annalena',
'animated',
'alvarado',
'alternate',
'alicante',
'alex2000',
'alabaster',
'aerospace',
'accurate',
'17171717',
Stop people using very common passwords If a user chooses a very common password then an attacker could guess it in relatively few attempts, circumventing the lockout. CESG recommend blacklisting the most common passwords: > …enforcing the requirement for complex character sets in passwords is > not recommended. Instead, concentrate efforts on technical controls, > especially: > > - defending against automated guessing attacks by either using account > lockout, throttling, or protective monitoring > - blacklisting the most common password choices How I made this list: - went to the OWASP repository of security lists: https://github.com/danielmiessler/SecLists - downloaded `10k_most_common.txt`, `twitter-banned.txt` and `500-worst-passwords.txt` - filtered out any under 8 characters: ``` sed -r '/^.{,7}$/d' passwords-twitter.txt > passwords-combined.txt sed -r '/^.{,7}$/d' passwords-500.txt >> passwords-combined.txt sed -r '/^.{,7}$/d' passwords.txt >> passwords-combined.txt ``` - filtered out any duplicates: ``` cat passwords-combined.txt | awk '!x[$0]++' > passwords-combined-deduped.txt ```
2016-09-27 11:28:12 +01:00
]
Reference in New Issue Copy Permalink