In our example, we’ll make use of the rockyou.txt password dictionary. If they are lucky, they’ll hit the right one and be allowed in.Īttackers have a lot of passwords available at their disposal as a result of all the data breaches major websites have faced over the years. A dictionary attack is usually as simple as an attacker trying a list of common passwords against a username. So attackers usually opt for something simpler and faster which yields better results - a dictionary attack. In almost any case bruteforce attacks take way too long to be practical. An attacker can try to pull off a bruteforce attack, which involves them trying all possible combinations of a password. So they will need to opt for an online attack.

However, hopefully, an attacker does not have a copy of your WordPress database. Offline password cracking is orders of magnitude faster. In an offline attack the attackers try to crack password hash es which they downloaded from a hacked target on their servers. They keep on trying until they find a username and password combination that works. In an online method the attackers try to log in using a login form on the target. Some are online methods and some other are offline. There are several methods you can use to crack passwords. WordPress password dictionary attackīefore diving into how we can use WPScan to find weak WordPress passwords, let’s first briefly cover what a dictionary attack is. This article covers how to do just this using the free and open source WPScan tool. However, even then, you’re still likely to want to audit your WordPress password strength from time to time. To such an extent, as a WordPress administrator, one of your best defenses against such an attack is to enforce password complexity requirements, also commonly known as a password policy. This means that while your WordPress website may be secure, if a user is using an easy-to-guess password, it’s not unrealistic to think that they could very well bypass your WordPress security. As Have I Been Pwned demonstrates, many users’ accounts would have been leaked in at least one data breach. To make matters worse, the vast majority of users use easy to guess passwords and also re-use them across accounts. Strong passwords are hard to remember, unless your users follow best practices and use a password manager. Users aren’t generally fans of strong passwords. While there are several facets of WordPress security which as a WordPress administrator you can control, users’ passwords are unfortunately not one of them.

Password dictionary list download