Sometimes if you’re performing a password bruteforce attack, either against local hashes or remotely against a service, you could use password lists rather than a pure bruteforce (incremental) one. People are most likely to use dictionary words, names, keyboard combinations or anything related to it. These passwords lists can be found anywhere online.
The problem sometimes happens that when you *know* the password policy, but your password list holds a lot of combinations that you know won’t work; simply passwords that are too short or don’t have a number in them or so.
For example, a service requires at least 6 characters, and have one of them being a digit; so you know that entries such as “jesus”, “satan” and “password” won’t work. Still, they are being tried.
For an audit on a company, I ran into that problem – so I wrote a quick and dirty perl script to take a large password list, and only output passwords that adhere to a certain policy. These include minimum and maximum length, as well as password complexity (has to have a digit, uppercase, …)
You can find it on my GitHub.
Enjoy!
-mh
Leave a Reply