Integrate Generalized Suffix Tree Into Dictionary Attack

It is not rare that one person use the same password across his/her different accounts or use same substring(s) to build different passwords. Similarly, different persons may use the same passwords or same substring(s) in their passwords. How do the shared passwords or substrings impact the strength of the passwords? In this research, we find that using the dictionaries with shared substrings can easily and effectively crack most hashed passwords. We used Generalized Suffix Tree to systematically analyze more than 35 million plaintext passwords. The shared substrings found by Generalized Suffix Tree are compiled into dictionaries/word lists. By using these dictionaries, the Dictionary Attack of Hashcat cracked 89%, 80%, 90%, 89% of English, Russian, Chinese, and French domain passwords respectively. In total, we attacked more than 2.4 million hashed passwords.