What
Over various penetration tests, I always found that there was no equivalent of a list of possible usernames in French. Following Hackfest’s latest blog post publishing a wordlist adapted to Québec, I decided to publish my own script that generates common usernames adapted to Québec.
Also, many passwords are still based on first and last names (of children, parents, wives, etc.). These are generally French names that are not (or barely) part of standard wordlists. Using sites that publish information on the most popular names, such as prenomsquebec.ca, and a Wikipedia article, it is possible to create many combinations.
So I present the Github repository QC_Username_Generator.
Features
- Generate popular usernames based on Québec names
- Adapt the name format depending on the test or application
- Optionally add a domain name in case the username requires an email address
- Generate commonly used passwords (combinations of names and years)
This script generates several username variations based on the most popular last names (top 1000) and first names in Québec since 1980.
It can also add a variation with a domain name to generate potential email addresses (e.g. [email protected]). The usernames can then easily be used for password spraying or simply for enumeration. In addition, it can generate passwords that include the name and the year (e.g. Tremblay2020!, jean2021, ..). Sorry if that’s your password!
They can then be used on their own for password cracking, in combination with other lists such as w0lfd3n, or added to Hashcat rules.
Use cases
- For password spraying
- To perform user enumeration
- To generate a wordlist of possible passwords during password cracking
Usage examples
- The script is based on Python3 and requires no external modules.
- The name lists are stored in the source folder.
The various possible arguments:
[-u] permet de générer une liste d'utilisateurs [-w] permet de générer une liste de mot de passe [-d] spécifie que vous voulez une liste contenant un domaine/courriel (ex: [email protected]) [-o] pour spécifier le nom du fichier en sortie (exemple.txt), sinon ce sera affiché en STDOUT
To generate a list containing email addresses to a text file:
python3 main.py -u -d -o fichier
To generate a list of usernames to a text file:
python3 main.py -u -o fichier
To generate a list of potential passwords to a text file:
python3 main.py -w -o fichier
Final word
As always, we recommend using a password manager such as BitWarden or KeePassXC to generate complex passwords and store them securely.
You can contact me on the Hackfest Discord: @redshell
Photo credit: christiaancolen - CC BY license
