up vote 4 down vote favorite
share [g+] share [fb]

How can I test passwords against a dictionary / word list, where the entries have been fuzzed to some degree?

By "fuzzed", I mean variants of words with "l33t" conversions and other character conversions are included in the check.

Ideally, I would like to pass in a password value, have the utility check the password, and return a yes/no value.

link|improve this question
67% accept rate
What did you want it to return? Are you just looking to see if the password would be in a common rainbow table? – Psycho Bob Feb 11 '10 at 21:50
your using the word fuzz incorrectly. Fuzzing is a type of software testing. You mean to say Brute Force. – Rook Feb 13 '10 at 5:58
You are talking about a dictionary attack with transformations. Any time you are relying on making a ton of guesses to break the secuirty system you are doing brute force, in this case it is intelligent brute force. I have written fuzzers and I can tell you they are completely unrelated. – Rook Feb 14 '10 at 7:47
sorry for the delay on accepting an answer. I still need to test. – pcapademic Mar 15 '10 at 21:42
feedback

3 Answers

up vote 2 down vote

John the Ripper has modes which can be used to test password strength against a fuzzed list. It supports creating your own fuzzing rules, and uses whatever dictionaries you provide. It comes by default with a large set of common fuzzing rules installed, including 1337 transformation, word flipping, doubling, uppercasing, simple number/symbol appending, etc.

link|improve this answer
feedback
up vote 1 down vote

If you search google for your password and you find even 1 result, then you have chosen a weak password. NO ONE should know your password, even if they don't know that its yours.

For testing remote system for weak passwords I highly recommend THC-Hydra. I have used this software in penetration tests with great success.

link|improve this answer
feedback
up vote 0 down vote

JTR only applies to hashes, if you're looking to do a little more of a 'penetration test' across the network. Hydra by THC is widely known Network password cracker (But note, With all the extensions, You will be waiting a VERY long time to find even the simplest passwords).

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.