How can I generate custom brute-force dictionaries?

  • I have found during testing that companies often use variations of their names for critical passwords (for example Microsoft's password might be M1cr0s0f+ or m1cros0ft etc etc).

    So if I gave it the phrase "stack exchange' it would ideally compute as many logical variations as possible including things like:

    stack_exchange!
    

    I've seen many dictionary generators but they all seem to do something along the lines of

    aaaaaaa
    aaaaaab
    aaaaaac
    aaaaaad
    

    I'm wondering if there are any tools available that will allow me to generate a large number of permutations given a 'starting' word.

    Use the Python Luke!

    @TerryChia yeah, that's my fall-back plan but a pre-existing solution would help greatly :)

    Seriously though, is there a need to do this? I thought common password crackers like `john` already mangle whatever dictionaries you throw at it?

  • Try using crunch - wordlist generator.

    Usage is:

    ./crunch <from-len> <to-len> [-f <path to charset.lst> charset-name] [-o wordlist.txt or START] [-t [FIXED]@@@@] [-s startblock]
    

    -t option allows you to specify a pattern, eg: st%ck^%xch%ng%

    Where only

    • the @'s will change with lowercase letters
    • the ,'s will change with uppercase letters
    • the %'s will change with numbers
    • the ^'s will change with symbols

    Running as following:

    ./crunch 14 14 -t st%ck^%xch%ng% -o wordlist.txt
    

    gives 330000 results:

    st0ck!0xch0ng0
    st0ck!0xch0ng1
    st0ck!0xch0ng2
    st0ck!0xch0ng3
    st0ck!0xch0ng4
    st0ck!0xch0ng5
    st0ck!0xch0ng6
    ...
    

    You can also modify the charset if you think it's insufficient.

License under CC-BY-SA with attribution


Content dated before 7/24/2021 11:53 AM