The Predictable Password
How a wordlist is built, how big it gets, and why a life story can be a password
Dr. Ahmet Furkan Aydogan · aydogana@uncw.edu · Department of Computer Science, UNCW
Abstract. A password is only a secret if it is hard to guess. In this lab you build a wordlist, a plain file of password candidates, on your own Parrot OS machine, and you learn to count before you generate: how many candidates a character set and a length produce, and how large the file becomes on disk. You start with every six digit PIN, watch the file reach seven megabytes, then calculate how the numbers explode once letters and symbols join in. Then you turn the idea around: you read a fictional person's life and turn their dog, their town, and their birth year into a short, targeted list that guesses their five character password in seconds. Everything you attack is the training panel set up for this course.
What you will do
- Open a terminal, walk to your Desktop, and build a workspace with
pwd, ls, cd, and mkdir.
- Generate every six digit PIN with
crunch, then measure the file with wc, ls -l, and du.
- Calculate how the candidate count and file size grow as the character set widens to letters, then symbols.
- Learn to stop a runaway command safely, and tell
Ctrl+C, Ctrl+Z, and Ctrl+X apart.
- Follow a guided example that turns a fictional person's biography into a targeted wordlist and recovers their login.
- On your own, read the John Doe profile, obey the sign-up rules, build a targeted wordlist, and recover his login on the authorized panel.
How to start
- Download the two documents below. Follow the handout step by step; record every value and paste every screenshot into the worksheet.
- Open the lab with the Launch Lab button. Enter your 9-digit Student ID to begin, then read John Doe's site, study the sign-up rules, and recover his login.
- Your only target is this John Doe training panel. Do not point any tool at the course portal, your student login, a classmate, or any real website.
Academic integrity, scope, and ethics. Individual work. Every biography in this lab is fictional and the target is a training panel set up for this course; no real person or system is involved. Password guessing is legal on a target you own or are explicitly authorized to test; run it against someone else and it is a crime. The technique is neutral; the target and the authorization are what make it right or wrong.