5

How can I test passwords against a dictionary / word list, where the entries have been fuzzed to some degree?

By "fuzzed", I mean variants of words with "l33t" conversions and other character conversions are included in the check.

Ideally, I would like to pass in a password value, have the utility check the password, and return a yes/no value.

4
  • What did you want it to return? Are you just looking to see if the password would be in a common rainbow table?
    – Psycho Bob
    Feb 11, 2010 at 21:50
  • your using the word fuzz incorrectly. Fuzzing is a type of software testing. You mean to say Brute Force.
    – Rook
    Feb 13, 2010 at 5:58
  • You are talking about a dictionary attack with transformations. Any time you are relying on making a ton of guesses to break the secuirty system you are doing brute force, in this case it is intelligent brute force. I have written fuzzers and I can tell you they are completely unrelated.
    – Rook
    Feb 14, 2010 at 7:47
  • sorry for the delay on accepting an answer. I still need to test.
    – pcapademic
    Mar 15, 2010 at 21:42

3 Answers 3

3

John the Ripper has modes which can be used to test password strength against a fuzzed list. It supports creating your own fuzzing rules, and uses whatever dictionaries you provide. It comes by default with a large set of common fuzzing rules installed, including 1337 transformation, word flipping, doubling, uppercasing, simple number/symbol appending, etc.

1

If you search google for your password and you find even 1 result, then you have chosen a weak password. NO ONE should know your password, even if they don't know that its yours.

For testing remote system for weak passwords I highly recommend THC-Hydra. I have used this software in penetration tests with great success.

0

JTR only applies to hashes, if you're looking to do a little more of a 'penetration test' across the network. Hydra by THC is widely known Network password cracker (But note, With all the extensions, You will be waiting a VERY long time to find even the simplest passwords).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.