Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was just reading a discussion about cracking passwords that said the person running the tool might know things about the target like the birthday of his first girlfriend's dog but the tool won't.

This got me thinking. Are there password guessing tools that can include as input a list of known facts about the target, possibly obtained through social engineering, such as important dates and names of family, pets, persons they have various kinds of relationships with?

Such a tool could weight things like the years, the days of the week, names of months, in the dates, and first names, surnames, nicknames, pet names etc to give them higher priority in combinatorial dictionary attacks.

share|improve this question
add comment

3 Answers

up vote 7 down vote accepted

Who's your daddy

CUPP

Description and download link is in the linked page(s). Downside is (as far as I know) they can be only used under Linux.

share|improve this answer
    
Just what I was looking for @StupidOne! –  hippietrail Aug 12 '11 at 18:39
add comment

Are there password guessing tools that can include as input a list of known facts about the target [...]?

A password "auditing" tool with support for arbitrary dictionary files, permutation, character substitution and word combining should do the trick. One tool that springs to mind is our old friend L0pthcrack.

However, the potential increase in likelihood for making a successful guess by including this data remains in my opinion questionable. If social engineering is involved a direct attack on the user password is, in my experience, both easier and more likely to be successful.

share|improve this answer
    
I'm interested in the theory and math behind it. I imagine this kind of thing would help like pruning helps in game trees. Perhaps I wrongly used the phrase "social engineering". I didn't want to imply that an attacker/auditor had full manipulative power over the target, just that they knew more than a naive algorithm. The types of things you would try if manually trying to guess somebody's password. But able to be put through many automatic permutations and combinations. –  hippietrail Aug 12 '11 at 18:35
add comment

Uh, you'd just use whatever tools were on your system to mung the source files into a usable dictionary file, and then use your cracking tools permutation mode. Or you'd use some software permutation tool to create the dictionary.

I imagine there'd be lots of pipes and semi-obscure gnu utilities being used.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.