I'm building a common usernames and passwords list for use with THC-Hydra. I'm wondering how best to format the thing. Should I completely seperate usernames from passwords, and maintain two seperate files. Or would it be best to combine the two into a single list, since some usernames can be used as a password, and vice versa?

As you can imagine it's not a well documented procedure. I've found a few common username/password lists, but they usually have them combined into a user:pass style file. Is that the norm? Should I split off the :pass into their own passwords file, or would it be ok for hydra to use the full list, treating passwords as usernames as well?

Generally you'll put usernames and passwords in a separate file, and most brute force clients will also provide you an option to try usernames as passwords too.

Putting them both in the same file, and having all username/password combinations in there might make your attack faster, if your brute force client is the limiting factor, but it'll also make the list HUGE. Generally the speed of the internet connection or the amount of tries per time unit the server allows is what limits how fast you can go, so it'll not give you a performance increase in that case.

Thanks a lot for the advice. One of the things that concerned me was how bit it might get if I started adding everything into the same file.

Well, if you have a linux machine or shell, there's some pretty easy commands you can use:

Adding all the files into one big file:

Code: Select all

cat file1.txt >> full_list.txt
cat file2.txt >> full_list.txt
cat file3.txt >> full_list.txt
etc.


Sorting and removing double entries:

Code: Select all

sort -u full_list.txt > sorted_list.txt


Use sort -uf if you want it to ignore upper/lowercase. Some brute force applications do these things for you.