Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I test passwords against a dictionary / word list, where the entries have been fuzzed to some degree?

By "fuzzed", I mean variants of words with "l33t" conversions and other character conversions are included in the check.

Ideally, I would like to pass in a password value, have the utility check the password, and return a yes/no value.

share|improve this question
What did you want it to return? Are you just looking to see if the password would be in a common rainbow table? – Psycho Bob Feb 11 '10 at 21:50
your using the word fuzz incorrectly. Fuzzing is a type of software testing. You mean to say Brute Force. – Rook Feb 13 '10 at 5:58
You are talking about a dictionary attack with transformations. Any time you are relying on making a ton of guesses to break the secuirty system you are doing brute force, in this case it is intelligent brute force. I have written fuzzers and I can tell you they are completely unrelated. – Rook Feb 14 '10 at 7:47
sorry for the delay on accepting an answer. I still need to test. – pcapademic Mar 15 '10 at 21:42

John the Ripper has modes which can be used to test password strength against a fuzzed list. It supports creating your own fuzzing rules, and uses whatever dictionaries you provide. It comes by default with a large set of common fuzzing rules installed, including 1337 transformation, word flipping, doubling, uppercasing, simple number/symbol appending, etc.

share|improve this answer

If you search google for your password and you find even 1 result, then you have chosen a weak password. NO ONE should know your password, even if they don't know that its yours.

For testing remote system for weak passwords I highly recommend THC-Hydra. I have used this software in penetration tests with great success.

share|improve this answer

JTR only applies to hashes, if you're looking to do a little more of a 'penetration test' across the network. Hydra by THC is widely known Network password cracker (But note, With all the extensions, You will be waiting a VERY long time to find even the simplest passwords).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.