Generating Personalized Wordlists by Analyzing Targets Tweets

In this presentation at the DEF CON 27 Recon Village, security researcher Utku Sen introduces Rhodiola, an open-source OSINT reconnaissance tool that uses Natural Language Processing (NLP) to generate highly personalized password wordlists by analyzing a target's public Twitter timeline. He begins by addressing the inefficiency of massive generic password dictionaries, explaining that while standard lists contain hundreds of millions of candidates, users routinely choose passwords derived from their personal interests, hobbies, family, and pets.

Utku outlines the architecture of Rhodiola, which collects a target's recent tweets via the Twitter API and runs them through a text-cleaning pipeline built on Python's Natural Language Toolkit (NLTK). The tool systematically removes common stop words, verbs, and conversational filler, isolating nouns and proper nouns that represent meaningful entities. He then shows how Rhodiola integrates with WordNet to identify semantic associations, expanding the target's explicit interests into related contextual keywords and themes.

Finally, Utku explains how Rhodiola applies rule-based transformations to combine extracted terms with common password suffixes, birth years, and leetspeak substitutions. By benchmarking the resulting custom wordlists against conventional brute-force dictionaries, he demonstrates a dramatic reduction in guess attempts required to compromise personal accounts. He concludes by discussing defensive operational security practices to minimize personal data exposure on public social media feeds. (AI summary — Gemini Flash)