iphelix/packPACK (Password Analysis and Cracking Kit)
PACK (Password Analysis and Cracking Toolkit) is a collection of utilities developed to aid in analysis of password lists in order to enhance password cracking through pattern detection of masks, rules, character-sets and other password characteristics. The toolkit generates valid input files for Hashcat family of password crackers.
NOTE: The toolkit itself is not able to crack passwords, but instead designed to make operation of password crackers more efficient.
Before we can begin using the toolkit we must establish a selection criteria of password lists. Since we are looking to analyze the way people create their passwords, we must obtain as large of a sample of leaked passwords as possible. One such excellent list is based on RockYou.com compromise. This list both provides large and diverse enough collection that provides a good results for common passwords used by similar sites (e.g. social networking). The analysis obtained from this list may not work for organizations with specific password policies. As such, selecting sample input should be as close to your target as possible. In addition, try to avoid obtaining lists based on already cracked passwords as it will generate statistics bias of rules and masks used by individual(s) cracking the list and not actual users.
The most basic analysis that you can perform is simply obtaining most common length, character-set and other characteristics of passwords in the provided list. In the example below, we will use 'rockyou.txt' containing approximately 14 million passwords. Launch statsgen.py with the following command line:
$ python statsgen.py rockyou.txt
Below is the output from the above command:
_
StatsGen #.#.# | |
_ __ __ _ ___| | _
| '_ \ / _` |/ __| |/ /
| |_) | (_| | (__| <
| .__/ \__,_|\___|_|\_\
| |
|_| [email protected]
[*] Analyzing passwords in [rockyou.txt]
[+] Analyzing 100% (14344390/14344390) of passwords
NOTE: Statistics below is relative to the number of analyzed passwords, not total number of passwords
[*] Length:
[+] 8: 20% (2966037)
[+] 7: 17% (2506271)
[+] 9: 15% (2191039)
[+] 10: 14% (2013695)
[+] 6: 13% (1947798)
...
[*] Character-set:
[+] loweralphanum: 42% (6074867)
[+] loweralpha: 25% (3726129)
[+] numeric: 16% (2346744)
[+] loweralphaspecialnum: 02% (426353)
[+] upperalphanum: 02% (407431)
...
[*] Password complexity:
[+] digit: min(0) max(255)
[+] lower: min(0) max(255)
[+] upper: min(0) max(187)
[+] special: min(0) max(255)
[*] Simple Masks:
[+] stringdigit: 37% (5339556)
[+] string: 28% (4115314)
[+] digit: 16% (2346744)
[+] digitstring: 04% (663951)
[+] othermask: 04% (576324)
...
[*] Advanced Masks:
[+] ?l?l?l?l?l?l?l?l: 04% (687991)
[+] ?l?l?l?l?l?l: 04% (601152)
[+] ?l?l?l?l?l?l?l: 04% (585013)
[+] ?l?l?l?l?l?l?l?l?l: 03% (516830)
[+] ?d?d?d?d?d?d?d: 03% (487429)
...
NOTE: You can reduce the number of outliers displayed by including the --hiderare flag which will not show any items with occurrence of less than 1%.
Here is what we can immediately learn from the above list:
The last section, "Advanced Masks", contains most frequently occurring masks using the Hashcat format. Individual symbols can be interpreted as follows:
?l - a single lowercase character
?u - a single uppercase character
?d - a single digit
?s - a single special character
For example, the very first mask, "?l?l?l?l?l?l?l?l", will match all of the lowercase alpha passwords. Given the sample size you will be able to crack approximately 4% of passwords. However, after generating the initial output, you may be interested in using filters to narrow down on password data.
Let's see how RockYou users tend to select their passwords using the "stringdigit" simple mask (a string followed by numbers):
$ python statsgen.py ../PACK-0.0.3/archive/rockyou.txt --simplemask stringdigit -q --hiderare
[*] Analyzing passwords in [rockyou.txt]
[+] Analyzing 37% (5339556/14344390) of passwords
NOTE: Statistics below is relative to the number of analyzed passwords, not total number of passwords
[*] Length:
[+] 8: 23% (1267260)
[+] 7: 18% (981432)
[+] 9: 17% (939971)
[+] 10: 14% (750938)
[+] 6: 11% (618983)
[+] 11: 05% (294869)
[+] 12: 03% (175875)
[+] 13: 01% (103047)
[+] 14: 01% (65958)
[*] Character-set:
[+] loweralphanum: 88% (4720184)
[+] upperalphanum: 06% (325941)
[+] mixedalphanum: 05% (293431)
[*] Password complexity:
[+] digit: min(1) max(252)
[+] lower: min(0) max(46)
[+] upper: min(0) max(31)
[+] special: min(0) max(0)
[*] Simple Masks:
[+] stringdigit: 100% (5339556)
[*] Advanced Masks:
[+] ?l?l?l?l?l?l?d?d: 07% (420318)
[+] ?l?l?l?l?l?d?d: 05% (292306)
[+] ?l?l?l?l?l?l?l?d?d: 05% (273624)
[+] ?l?l?l?l?d?d?d?d: 04% (235360)
[+] ?l?l?l?l?d?d: 04% (215074)
...
The very top of the output specifies what percentage of total passwords was analyzed. In this case, by cracking only passwords matching the "stringdigit" mask it is only possible to recover about 37% of the total set just as was displayed in the original output. Next, it appears that only 11% of this password type use anything other than lowercase. So it would be smart to concentrate on only lowercase strings matching this mask. At last, in the "Advanced Mask" section we can see that the majority of "stringdigit" passwords consist of a string with two or four digits following it. With the information gained from the above output, we can begin creating a mental image of target users' password generation patterns.
There are a few other filters available for password length, mask, and character sets:
Length: --minlength and/or --maxlength
Simple Mask: --simplemask [numeric, loweralpha, upperalpha, mixedalpha, loweralphanum, etc.]
Character sets: --charset [digit, string, stringdigit, digitstring, digitstringdigit, etc.]
NOTE: More than one filter of the same class can be specified as a comma-separated list:
--simplemask="stringdigit,digitstring"
While the "Advanced Mask" section only displays patterns matching greater than 1% of all passwords, you can obtain and save a full list of password masks matching a given dictionary by using the following command:
$ python statsgen.py rockyou.txt -o rockyou.masks