I was just reading a discussion about cracking passwords that said the person running the tool might know things about the target like the birthday of his first girlfriend's dog but the tool won't.

This got me thinking. Are there password guessing tools that can include as input a list of known facts about the target, possibly obtained through social engineering, such as important dates and names of family, pets, persons they have various kinds of relationships with?

Such a tool could weight things like the years, the days of the week, names of months, in the dates, and first names, surnames, nicknames, pet names etc to give them higher priority in combinatorial dictionary attacks.

3 Answers 3


Who's your daddy


Description and download link is in the linked page(s). Downside is (as far as I know) they can be only used under Linux.

  • Just what I was looking for @StupidOne! Aug 12, 2011 at 18:39

Uh, you'd just use whatever tools were on your system to mung the source files into a usable dictionary file, and then use your cracking tools permutation mode. Or you'd use some software permutation tool to create the dictionary.

I imagine there'd be lots of pipes and semi-obscure gnu utilities being used.


Are there password guessing tools that can include as input a list of known facts about the target [...]?

A password "auditing" tool with support for arbitrary dictionary files, permutation, character substitution and word combining should do the trick. One tool that springs to mind is our old friend L0pthcrack.

However, the potential increase in likelihood for making a successful guess by including this data remains in my opinion questionable. If social engineering is involved a direct attack on the user password is, in my experience, both easier and more likely to be successful.

  • I'm interested in the theory and math behind it. I imagine this kind of thing would help like pruning helps in game trees. Perhaps I wrongly used the phrase "social engineering". I didn't want to imply that an attacker/auditor had full manipulative power over the target, just that they knew more than a naive algorithm. The types of things you would try if manually trying to guess somebody's password. But able to be put through many automatic permutations and combinations. Aug 12, 2011 at 18:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .