ASCII Art in Password Cracking
Just a quick warning but almost all the links presented here are NSFW, (more from an embarrassment factor due to ascii representations of male and female genitalia).
/><{{{{"> --fish
///\oo/\\\ --spider
d[ o_0 ]b --robot
You get the idea. Of course the most common ascii art used is that of the male genitalia. I'll spare you the examples of that on the front page of this blog ;)
As pointed out in the comments of this post not all passwords are created from dictionary words or pass-phrases. One other way of creating a password is to use ascii art instead. For example:
/><{{{{"> --fish
///\oo/\\\ --spider
d[ o_0 ]b --robot
You get the idea. Of course the most common ascii art used is that of the male genitalia. I'll spare you the examples of that on the front page of this blog ;)
The question then is what is the best way to attack these passwords? My gut feeling is that a standard dictionary based approach is the way to go, but instead of input words you can use a wordlist full of ascii art instead. To test this I googled various terms such as "ascii penis", "ascii porn", "one line ascii art", along with some actual pictures of said ascii art to collect as many examples as possible. One a side note, I hate to envision what Google thinks of me based on my browsing history...
What I found is that most people used variations of common "construction" techniques of their ascii pictures. For example the shaft is usually either '=' or '-'. There are common heads, bases, depictions of sperm, and depictions of what said ejaculation is landing on. I then threw all of this into a script and had it output all the possible different combinations. The end result is a little over 3 million examples of NSFW ascii art for use in password cracking. You can get a copy of the wordlist here. In all likelihood it's the largest collection of ascii porn on the internet. That's exactly what I thought I would be creating when I decided to go for my PhD. Sigh, at least it's better than frog fluffing, (a reference to the movie beerfest).
The list is rather large since I included a lot of options that probably won't be used in real life, such as 'p' to represent someone with only one ball, (people on the internet are inventive, what can I say). Also spacing added quite a bit to it since in password cracking the spaces used/not used do make a difference. If you have any examples I missed please post them in the comments of the site where I'm hosting the wordlist as I'd rather avoid getting my inbox filled with depictions of ascii penises and vaginas.
The next step is to create another wordlist containing "normal" ascii art such as hearts, frogs, etc. Once I have that done I'll post that as well.
One final note. Despite all the joking, I seriously considered not writing this post or making this wordlist available since I do like to maintain a shred of dignity, professionalism, etc. The thing is, people actually create passwords this way so something like this wordlist is needed by the community. I'd really appreciate it though if you kept this post off of digg, slashdot, don't submit it for an ignobel award, etc so it stays "in-house".
Comments
I'd also venture that the majority of users familiar with ASCII art who would use it for a password are also probably more "involved" in IT and therefore cracking their accounts may subsequently yield greater "reward". In short- my original comment was no joke.