Hydraze & Friends blog

Hello folks,

Few days ago, the linkedin password dump was released. It’s made of 6458020 sha1 unsalted-hashes. Yes, we are in 2012 and big websites still use unsalted hashes to store your passwords…
The dump is made of two different sort of hashes :

• there are 3.521.180 “00000” masked hashes (e.g. 0000054bc8172921062252506762fd36a5f8a6ca)
•  and 2.936.840 “normal” hashes.

While the origin of the masked hashes remains unknown, some people think that the hacker who released the dump masked the hashes he had already recovered. Anyway, we can recover those hashes. The hashcat author released two special versions of his tools (hashcat and oclhashcat) which support those zeroed hashes.

I ran pipal over the 2.723.345 passwords I recovered and here is the output (NB: passwords which are smaller than 6 chars are due to zeroed hashes) :


Total entries = 2723345
Total unique entries = 2723345

Top 10 base words
linkedin = 4369 (0.16%)
link = 2423 (0.09%)
linked = 2207 (0.08%)
alex = 1309 (0.05%)
mike = 1260 (0.05%)
june = 1129 (0.04%)
password = 1109 (0.04%)
love = 1073 (0.04%)
john = 990 (0.04%)
july = 937 (0.03%)

Password length (length ordered)
1 = 5 (0.0%)
2 = 10 (0.0%)
3 = 14 (0.0%)
4 = 33 (0.0%)
5 = 59 (0.0%)
6 = 576661 (21.17%)
7 = 477202 (17.52%)
8 = 859497 (31.56%)
9 = 393484 (14.45%)
10 = 233247 (8.56%)
11 = 95945 (3.52%)
12 = 49188 (1.81%)
13 = 19305 (0.71%)
14 = 10510 (0.39%)
15 = 4599 (0.17%)
16 = 3130 (0.11%)
17 = 229 (0.01%)
18 = 139 (0.01%)
19 = 39 (0.0%)
20 = 33 (0.0%)
21 = 16 (0.0%)
22 = 5 (0.0%)
23 = 5 (0.0%)
24 = 9 (0.0%)
26 = 3 (0.0%)
27 = 2 (0.0%)
34 = 2 (0.0%)
40 = 2 (0.0%)

Password length (count ordered)
8 = 859497 (31.56%)
6 = 576661 (21.17%)
7 = 477202 (17.52%)
9 = 393484 (14.45%)
10 = 233247 (8.56%)
11 = 95945 (3.52%)
12 = 49188 (1.81%)
13 = 19305 (0.71%)
14 = 10510 (0.39%)
15 = 4599 (0.17%)
16 = 3130 (0.11%)
17 = 229 (0.01%)
18 = 139 (0.01%)
5 = 59 (0.0%)
19 = 39 (0.0%)
20 = 33 (0.0%)
4 = 33 (0.0%)
21 = 16 (0.0%)
3 = 14 (0.0%)
2 = 10 (0.0%)
24 = 9 (0.0%)
1 = 5 (0.0%)
23 = 5 (0.0%)
22 = 5 (0.0%)
26 = 3 (0.0%)
34 = 2 (0.0%)
27 = 2 (0.0%)
40 = 2 (0.0%)

        |
        |
        |
        |
        |
      | |
      | |
      |||
      ||||
      ||||
      ||||
      |||||
      |||||
      |||||
      ||||||
|||||||||||||||||||||||||||||||||||||||||
00000000001111111111222222222233333333334
01234567890123456789012345678901234567890

One to six characters = 576776 (21.18%)
One to eight characters = 1913473 (70.26%)
More than eight characters = 809872 (29.74%)

Only lowercase alpha = 710811 (26.1%)
Only uppercase alpha = 18614 (0.68%)
Only alpha = 729425 (26.78%)
Only numeric = 196384 (7.21%)

First capital last symbol = 16877 (0.62%)
First capital last number = 289330 (10.62%)

Months
january = 263 (0.01%)
february = 108 (0.0%)
march = 916 (0.03%)
april = 1101 (0.04%)
may = 4920 (0.18%)
june = 1596 (0.06%)
july = 1116 (0.04%)
august = 722 (0.03%)
september = 192 (0.01%)
october = 376 (0.01%)
november = 287 (0.01%)
december = 285 (0.01%)

Days
monday = 259 (0.01%)
tuesday = 99 (0.0%)
wednesday = 35 (0.0%)
thursday = 46 (0.0%)
friday = 262 (0.01%)
saturday = 42 (0.0%)
sunday = 144 (0.01%)

Months (Abreviated)
jan = 8208 (0.3%)
feb = 1059 (0.04%)
mar = 34767 (1.28%)
apr = 2357 (0.09%)
may = 4920 (0.18%)
jun = 3995 (0.15%)
jul = 5133 (0.19%)
aug = 2589 (0.1%)
sept = 854 (0.03%)
oct = 1941 (0.07%)
nov = 3141 (0.12%)
dec = 2471 (0.09%)

Days (Abreviated)
mon = 16686 (0.61%)
tues = 119 (0.0%)
wed = 988 (0.04%)
thurs = 91 (0.0%)
fri = 3387 (0.12%)
sat = 2669 (0.1%)
sun = 6159 (0.23%)

Includes years
1975 = 2682 (0.1%)
1976 = 2707 (0.1%)
1977 = 2725 (0.1%)
1978 = 2851 (0.1%)
1979 = 2812 (0.1%)
1980 = 3358 (0.12%)
1981 = 2878 (0.11%)
1982 = 2873 (0.11%)
1983 = 2525 (0.09%)
1984 = 2592 (0.1%)
1985 = 2050 (0.08%)
1986 = 1621 (0.06%)
1987 = 1406 (0.05%)
1988 = 1194 (0.04%)
1989 = 1063 (0.04%)
1990 = 1055 (0.04%)
1991 = 1005 (0.04%)
1992 = 883 (0.03%)
1993 = 915 (0.03%)
1994 = 1079 (0.04%)
1995 = 1241 (0.05%)
1996 = 1329 (0.05%)
1997 = 1423 (0.05%)
1998 = 1647 (0.06%)
1999 = 2064 (0.08%)
2000 = 7032 (0.26%)
2001 = 3913 (0.14%)
2002 = 3605 (0.13%)
2003 = 3461 (0.13%)
2004 = 3853 (0.14%)
2005 = 4361 (0.16%)
2006 = 4632 (0.17%)
2007 = 5370 (0.2%)
2008 = 6903 (0.25%)
2009 = 4212 (0.15%)
2010 = 5926 (0.22%)
2011 = 5351 (0.2%)
2012 = 1836 (0.07%)
2013 = 293 (0.01%)
2014 = 222 (0.01%)
2015 = 223 (0.01%)
2016 = 192 (0.01%)
2017 = 191 (0.01%)
2018 = 211 (0.01%)
2019 = 407 (0.01%)
2020 = 925 (0.03%)

Years (Top 10)
2000 = 7032 (0.26%)
2008 = 6903 (0.25%)
2010 = 5926 (0.22%)
2007 = 5370 (0.2%)
2011 = 5351 (0.2%)
2006 = 4632 (0.17%)
2005 = 4361 (0.16%)
2009 = 4212 (0.15%)
2001 = 3913 (0.14%)
2004 = 3853 (0.14%)

Single digit on the end = 302194 (11.1%)
Two digits on the end = 517715 (19.01%)
Three digits on the end = 182550 (6.7%)

Last number
0 = 152657 (5.61%)
1 = 326321 (11.98%)
2 = 168479 (6.19%)
3 = 182971 (6.72%)
4 = 126821 (4.66%)
5 = 126689 (4.65%)
6 = 114562 (4.21%)
7 = 136515 (5.01%)
8 = 124246 (4.56%)
9 = 130200 (4.78%)

 |
 |
 |
 |
 |
 |
 |
|||
||||
|||||| |||
||||||||||
||||||||||
||||||||||
||||||||||
||||||||||
||||||||||
0123456789

Last digit
1 = 326321 (11.98%)
3 = 182971 (6.72%)
2 = 168479 (6.19%)
0 = 152657 (5.61%)
7 = 136515 (5.01%)
9 = 130200 (4.78%)
4 = 126821 (4.66%)
5 = 126689 (4.65%)
8 = 124246 (4.56%)
6 = 114562 (4.21%)

Last 2 digits (Top 10)
23 = 62176 (2.28%)
01 = 53762 (1.97%)
11 = 44975 (1.65%)
12 = 38958 (1.43%)
00 = 37307 (1.37%)
10 = 31003 (1.14%)
07 = 25946 (0.95%)
99 = 24665 (0.91%)
08 = 23676 (0.87%)
22 = 22420 (0.82%)

Last 3 digits (Top 10)
123 = 44957 (1.65%)
000 = 11891 (0.44%)
007 = 11701 (0.43%)
234 = 11554 (0.42%)
001 = 9233 (0.34%)
008 = 7286 (0.27%)
111 = 6795 (0.25%)
010 = 6663 (0.24%)
011 = 5603 (0.21%)
999 = 5449 (0.2%)

Last 4 digits (Top 10)
1234 = 10480 (0.38%)
2000 = 6282 (0.23%)
2008 = 6253 (0.23%)
2010 = 5010 (0.18%)
2007 = 4850 (0.18%)
2011 = 4225 (0.16%)
2006 = 4169 (0.15%)
2005 = 3863 (0.14%)
2009 = 3757 (0.14%)
2004 = 3388 (0.12%)

Last 5 digits (Top 10)
12345 = 2761 (0.1%)
23456 = 1312 (0.05%)
54321 = 323 (0.01%)
00000 = 289 (0.01%)
11111 = 276 (0.01%)
77777 = 198 (0.01%)
56789 = 184 (0.01%)
45678 = 183 (0.01%)
55555 = 182 (0.01%)
34567 = 171 (0.01%)

Character sets
loweralphanum: 1273430 (46.76%)
loweralpha: 710811 (26.1%)
mixedalphanum: 315531 (11.59%)
numeric: 196384 (7.21%)
mixedalpha: 73563 (2.7%)
loweralphaspecialnum: 38019 (1.4%)
mixedalphaspecialnum: 34772 (1.28%)
upperalphanum: 26405 (0.97%)
upperalpha: 18614 (0.68%)
loweralphaspecial: 18524 (0.68%)
mixedalphaspecial: 7770 (0.29%)
specialnum: 2081 (0.08%)
upperalphaspecialnum: 1365 (0.05%)
upperalphaspecial: 541 (0.02%)
special: 145 (0.01%)

Character set ordering
stringdigit: 1285417 (47.2%)
allstring: 802988 (29.49%)
alldigit: 196384 (7.21%)
stringdigitstring: 140560 (5.16%)
othermask: 122874 (4.51%)
digitstring: 94211 (3.46%)
stringspecialdigit: 29406 (1.08%)
digitstringdigit: 26263 (0.96%)
stringspecialstring: 12081 (0.44%)
stringspecial: 10464 (0.38%)
specialstring: 1619 (0.06%)
specialstringspecial: 933 (0.03%)
allspecial: 145 (0.01%)

Hashcat masks (Top 10)
?l?l?l?l?l?l?l?l: 181520 (6.67%)
?l?l?l?l?l?l: 175640 (6.45%)
?l?l?l?l?l?l?d?d: 140556 (5.16%)
?l?l?l?l?l?l?l: 139030 (5.11%)
?l?l?l?l?l?l?l?l?l: 97059 (3.56%)
?d?d?d?d?d?d: 93337 (3.43%)
?l?l?l?l?d?d?d?d: 76274 (2.8%)
?l?l?l?l?l?d?d: 71933 (2.64%)
?l?l?l?l?l?l?l?l?l?l: 58785 (2.16%)
?l?l?l?l?l?l?l?d: 56318 (2.07%)