Hey there!

Searching through the rockyou.txt i have stumbled across a lot of weird stuff.

cat rockyou.txt | grep -i http
... <object width="425" height="355"><param name="movie" value="http://www.youtube.com/v/ytfimr8ogDY&rel=1"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/ytfimr8ogDY&rel=1" type="application/x-shockwave-flash" wm <object width="425" height="355"><param name="movie" value="http://www.youtube.com/v/s9cKnFRJHAo&rel=1&border=0"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/s9cKnFRJHAo&rel=1&border=0" type="application/x-s <object width="425" height="355"><param name="movie" value="http://www.youtube.com/v/5ep1AdKU9fU&rel=1"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/5ep1AdKU9fU&rel=1" type="application/x-shockwave-flash" wm <object width="425" height="355"><param name="movie" value="http://www.youtube.com/v/1m-Se_oeyLw"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/1m-Se_oeyLw" type="application/x-shockwave-flash" wmode="transpa <object width="425" height="355"><param name="movie" value="http://www.pixverse.com/api/pixwall?id=paVh85isGSau-YaVGV6VvkQ-room"></param><param name="wmode" value="transparent"></param><embed src="http://www.pixverse.com/api/pixwall?id=paVh85isGSau-YaVGV6 <object width="425" height="350"><param name="movie" value="http://www.youtube.com/v/gWr9_SrG2YY"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/gWr9_SrG2YY" type="application/x-shockwave-flash" wmode="transpa <object width="425" height="350"><param name="movie" value="http://www.youtube.com/v/a54istXl8qU"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/a54istXl8qU" type="application/x-shockwave-flash" wmode="transpa <object width="425" height="350"><param name="movie" value="http://www.youtube.com/v/PeLZEI7YYls"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/PeLZEI7YYls" type="application/x-shockwave-flash" wmode="transpa <object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/5F4f5Wv_rpw&hl=en&fs=1"></param><param name="allowFullScreen" value="true"></param><embed src="http://www.youtube.com/v/5F4f5Wv_rpw&hl=en&fs=1" type="application/x-shockw <object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/-t2-Re4IYqQ&hl=es&fs=1"></param><param name="allowFullScreen" value="true"></param><embed src="http://www.youtube.com/v/-t2-Re4IYqQ&hl=es&fs=1" type="application/x-shockw <object width="300" height="80"><param name="movie" value="http://media.imeem.com/m/sEnPQEGZe5"></param><param name="wmode" value="transparent"></param><embed src="http://media.imeem.com/m/sEnPQEGZe5" type="application/x-shockwave-flash" width="300" heigh <object width="300" height="110"><param name="movie" value="http://media.imeem.com/m/5Sko-vDT_u"></param><param name="wmode" value="transparent"></param><embed src="http://media.imeem.com/m/5Sko-vDT_u" type="application/x-shockwave-flash" width="300" heig <object classid=\\ <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=8,0,0,0" width="292" height="290" id="music_05" align="middle"><param name="allowScriptAccess" value="alwa <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7,0,0,0" width="283" height="144" id="tt" align="middle"><param name="allowScriptAccess" value="always" /> <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7,0,0,0" width="212" height="121" id="tt" align="middle"><param name="allowScriptAccess" value="always" /> ...

I don't think these are intended passwords.

I know that this repository was not updated in a long time, but I think this "pollution" of the rockyou.txt affects a lot of people due to ...

• this was the second result of my google search for rockyou
• this repo has a lot of fork and stars

Due to finding these entries in other wordlists I am pretty sure that you didn't add these entries to the password list.

My questions for you:

• Do you recall where you got the rockyou.txt from?
• Are you interested in having a "cleaner" list and merging it, so I know if it is worth the effort?

Kali

The Kali OS has a preinstalled rockyou.txt.gz. This wordlist has the same findings which means due to the age of the list and that the polluted list is preinstalled, it can be assumed that a lot of kali users use this polluted list.
I don't know from where kali pulls its wordlists but it is interesting that the native kali list is also polluted.

Findings

• youtube videos
• amazonaws
• embedings for apps.rockyou.com
• Plain HTML (DOCTYPE, div, tables, ...)

Of course, there is a lot of people using PI as a password but the number is wrong.
There is 3.1416 instead of 3.1415
Please fix this.

this is what I've got on Ubuntu 22:

> gunzip english.txt.g
gzip: english.txt.gz: not in gzip format

Also WinRAR decrunch this with no problem and system explorer says it is Gunzip file. What a mess?

Hello!

I'd like to add your code as a package into ArchStrike, however you don't seem to have a license file.

Is it possible for you to create a license?

Thanks