Let’s compare an ideal OTP system vs. a vulnerable system using a smart wordlist.
| Scenario | Total Possible Codes | Attempts per Second | Time to 50% Success (Full list) | Time to 50% Success (Top 1,000 list) | | :--- | :--- | :--- | :--- | :--- | | Ideal (no rate limit) | 1,000,000 | 100 | ~83 minutes | ~5 seconds | | Ideal (rate limit: 3 attempts/min) | 1,000,000 | 0.05 | ~347 days | ~11 hours | | Vulnerable (no lockout, 10 attempts/sec) | 1,000,000 | 10 | ~14 hours | < 2 minutes | 6 digit otp wordlist
Key takeaway: A smart wordlist of just 1,000 common OTPs can break into poorly protected accounts in under two minutes. Let’s compare an ideal OTP system vs
The existence of these wordlists enables several attack vectors: In security testing, you would never use the
000000
000001
...
123456
...
654321
...
999999
In security testing, you would never use the full list on a live production system without explicit authorization. Instead, use a targeted smart wordlist:
123456
111111
000000
121212
777777
123123
112233
654321
999999
696969