Add in numbers/years (simple scripting, hashcat, JtR) Add in the org keywords (a full combination creates a massive list, recommend starting with 1:1) Try other combinations of the dictionary, keywords, years Add in other mutators like 1337 replacements, capitalization tricks (John) Brute forcing (do not bother with this on-site) John's incremental modes, limited by types Crunch's raw brute-force attack (very, very time intensive - a complete waste of time without GPUs) DICTIONARY RESEARCH AND CREATION Before you arrive on-site it is important to have your password cracking tools downloaded and relevant dictionaries ready to go, as your main demonstration and use of these tools is to gain access to the organization's network. The effectiveness of this demonstration is drastically reduced if you already have had to ask for the password to connect to the Internet and update your dictionaries, tools, or so on. Some of these files (especially larger password dictionaries) can be quite large, so downloading them incountry is not recommended. Many password dictionary sites, such as SkullSecurity , maintain core dictionaries in multiple languages. If your target language is not available, some quick regular expression work can turn spell-check dictionaries (such as those used by LibreOffice into useful word lists. It is generally useful to always test with English in addition to the target language. CloudCracker and OpenWall have, for a fee, well-tested password dictionaries. KEYWORD GENERATION In addition, create a customized dictionary with words related to the subject as revealed in the Remote Assessment research: organization name, street address, phone number, email domain, wireless network name, etc. For the organization "ExampleOrg , which has its offices at 123 Central St., Federal District, Countryzstan , which does human rights and journalism work and was founded in 1992, some context-based dictionary additions would be: exampleorg example exa mple org 123 central federal district Page 81 of 240