If you want to generate a custom password list to attack an organization's web, ssh, or other services, there are a lot of combinations you might have to go through to cover the bases you're interested in. For example:
- Leetspeek is becoming more common, e.g. p@ssw0rd
- Appending a bang (!) or 123 is common
- Appending a single digit or a seasonal suffix (e.g. fall2015) is a common way to maintain the same password despite change policies
- Capitalized first letter
- There is always someone whose password has to do with either (a) the regional football team, (b) the Packers, or (c) the Bears.
- Many people incorporate some variation of their organization's name in their passwords
- Blah, blah, blah
I recently had an engagement where I felt it would be useful to generate some fall passwords as well as sports-oriented and organization-themed passwords in order to attempt to break into various services. It was a quick exercise to whip up this script:
It works by traversing a pseudo-tree (really a list of lists) representing the various ways in which each character of the specified word could be represented, and emitting all variations of that word with each suffix (e.g. fall2015) specified in the script. The transmute function in this script recursively iterates through possibilities similar to the way binary digits are incremented, starting with the characters nearest the end of the word and working its way toward the beginning of the word while iterating through each possible value for that character position. In this way, the script traverses the entire tree of likely password values for a given word. The script finally adds various common suffices to each resulting password. For a simple case, the word "abc" would emit the following list:
>python pwmunge.py abc abc abc! abc1 abc123 abc2015 abc2015! abc0915 abc915 abc1015 abcoct15 abcfall15 abcfall2015 @bc @bc! @bc1 @bc123 @bc2015 @bc2015! @bc0915 @bc915 @bc1015 @bcoct15 @bcfall15 @bcfall2015 Abc Abc! Abc1 Abc123 Abc2015 Abc2015! Abc0915 Abc915 Abc1015 Abcoct15 Abcfall15 Abcfall2015
The script is capable of limiting output to include only passwords within a particular range of lengths. Perhaps this could be used in conjunction with DigiNinja's CeWL to come up with a useful wordlist for a given organization. I haven't implemented argparse because this script has served its purpose, so you'll have to hack it up yourself to meet your needs. But, the algorithm herein provides a nice base to start with.
As you work with different organizations, you'll get a better feel for common password themes. Maybe this script can help you guess some of the pumpkin-spiced passwords of October, such as H@ll0ween2015. Happy hackin'!
As you work with different organizations, you'll get a better feel for common password themes. Maybe this script can help you guess some of the pumpkin-spiced passwords of October, such as H@ll0ween2015. Happy hackin'!
No comments:
Post a Comment