Are there password/passphrase guessers/crackers which can utilize facts supplied about the target?

Question

I was just reading a discussion about cracking passwords that said the person running the tool might know things about the target like the birthday of his first girlfriend's dog but the tool won't.

This got me thinking. Are there password guessing tools that can include as input a list of known facts about the target, possibly obtained through social engineering, such as important dates and names of family, pets, persons they have various kinds of relationships with?

Such a tool could weight things like the years, the days of the week, names of months, in the dates, and first names, surnames, nicknames, pet names etc to give them higher priority in combinatorial dictionary attacks.

Answer 1

Who's your daddy

CUPP

Description and download link is in the linked page(s). Downside is (as far as I know) they can be only used under Linux.

Answer 2

Uh, you'd just use whatever tools were on your system to mung the source files into a usable dictionary file, and then use your cracking tools permutation mode. Or you'd use some software permutation tool to create the dictionary.

I imagine there'd be lots of pipes and semi-obscure gnu utilities being used.

Answer 3

Are there password guessing tools that can include as input a list of known facts about the target [...]?

A password "auditing" tool with support for arbitrary dictionary files, permutation, character substitution and word combining should do the trick. One tool that springs to mind is our old friend L0pthcrack.

However, the potential increase in likelihood for making a successful guess by including this data remains in my opinion questionable. If social engineering is involved a direct attack on the user password is, in my experience, both easier and more likely to be successful.