Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have found during testing that companies often use variations of their names for critical passwords (for example microsoft's password might be M1cr0s0f+ or m1cros0ft etc etc).

So if i gave it the phrase "stack exchange' it would ideally compute as many logical variations as possible including things like:

stack_exchange!

I've seen many dictionary generators but they all seem to do something along the lines of

aaaaaaa
aaaaaab
aaaaaac
aaaaaad

I'm wondering if there are any tools available that will allow me to generate a large number of permutations given a 'starting' word.

share|improve this question
    
Use the Python Luke! –  Terry Chia Sep 11 '13 at 2:07
    
@TerryChia yeah, that's my fall-back plan but a pre-existing solution would help greatly :) –  NULLZ Sep 11 '13 at 4:37
    
Seriously though, is there a need to do this? I thought common password crackers like john already mangle whatever dictionaries you throw at it? –  Terry Chia Sep 11 '13 at 5:03
add comment

3 Answers

up vote 2 down vote accepted

Try using crunch - wordlist generator.

Usage is:

./crunch <from-len> <to-len> [-f <path to charset.lst> charset-name] [-o wordlist.txt or START] [-t [FIXED]@@@@] [-s startblock]

-t option allows you to specify a pattern, eg: st%ck^%xch%ng%

Where only

  • the @'s will change with lowercase letters
  • the ,'s will change with uppercase letters
  • the %'s will change with numbers
  • the ^'s will change with symbols

Running as following:

./crunch 14 14 -t st%ck^%xch%ng% -o wordlist.txt

gives 330000 results:

st0ck!0xch0ng0
st0ck!0xch0ng1
st0ck!0xch0ng2
st0ck!0xch0ng3
st0ck!0xch0ng4
st0ck!0xch0ng5
st0ck!0xch0ng6
...

You can also modify the charset if you think it's insufficient.

share|improve this answer
add comment

Have look through this tool list or this app. No guarantees about malware though, so run downloads through a scanner first.

share|improve this answer
    
From a quick read all of these programs seem to be specialized in cracking a specific format. Is there a dictionary generator among them that satisfies the OP's request? –  rath Sep 11 '13 at 5:50
1  
It seems that custom apps for this purpose don't get compiled often. If the OP want combinations starting with a specific word; most huge text editors can auto-inject a string at the beginning of each dictionary word. This is usually done by replacing instances of '\n' with '\n[word]'; only the first and last line then need to be manually edited. –  LateralFractal Sep 11 '13 at 6:27
    
Oop. I misread the OP's meaning of starting word. In that case, no - you'd need a custom app or sed command. –  LateralFractal Sep 11 '13 at 6:28
    
One of the apps of the SecurityExploded list might serve the purpose - HashKracker. The brute force and pattern modes seem to imply the ability to manipulate the dictionary down to one word while trying character permutations. –  LateralFractal Sep 11 '13 at 6:34
add comment

I'm not sure about the algorithmic implications (which means there's probably a lot to improve in my solution) but here goes:

Every letter has an alternate spelling. From your example, o would have the array of O,0 (the last one's a zero). Similarly s would get S,5 etc. Even NULL can be replaced with !,1,2,3... etc. Digraphs are also possible where applicable.

So you don't permutate on words, you permutate on letters. I'm not sure if a precompiled ruleset exists but it doesn't matter; the most time-consuming part is typing up the letter permutations. The main loop would be perfectly straightforward.

for($i=0; $i<strlen($word); $i++){
    $l=$word[$i];
    for($j=0; $j<strlen($perms[$l]); $j++){
        save(perms[$l][$j]);
    isUpper($l) ? $word[$i]=tolower($l) : $word[$i]=toupper($l);
    save($word);
}

for some PHP-flavored pseudocode. I chose PHP because associative arrays make it a bit more comfortable. In other words: Writing the tool yourself might be faster than actually searching for one.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.