CIP Cyber

Log In
Menu
Log In
  • Opinion
  • Product Reviews
  • Industrial Cybersecurity
  • Videos

PACK – Password Analysis & Cracking Toolkit

Table of Contents

PACK (Password Analysis and Cracking Toolkit) is a collection of utilities developed to aid in analysis of password lists in order to enhance password cracking through pattern detection of masks, rules, character-sets and other password characteristics. The toolkit generates valid input files for Hashcat family of password crackers.








Before we can begin using the toolkit we must establish a selection criteria of password lists. Since we are looking to analyze the way people create their passwords, we must obtain as large of a sample of leaked passwords as possible. One such excellent list is based on RockYou.com compromise. This list both provides large and diverse enough collection that provides a good results for common passwords used by similar sites (e.g. social networking). The analysis obtained from this list may not work for organizations with specific password policies. As such, selecting sample input should be as close to your target as possible. In addition, try to avoid obtaining lists based on already cracked passwords as it will generate statistics bias of rules and masks used by individual(s) cracking the list and not actual users.

The most basic analysis that you can perform is simply obtaining most common length, character-set and other characteristics of passwords in the provided list. In the example below, we will use ‘rockyou.txt’ containing approximately 14 million passwords. Launch statsgen.py with the following command line:

$ python statsgen.py rockyou.txt

                           _
         StatsGen #.#.#   | |
          _ __   __ _  ___| | _
         | '_  / _` |/ __| |/ /
         | |_) | (_| | (__|   <
         | .__/ __,_|___|_|_
         | |
         |_| iphelix@thesprawl.org

    [*] Analyzing passwords in [rockyou.txt]
    [+] Analyzing 100% (14344390/14344390) of passwords
        NOTE: Statistics below is relative to the number of analyzed passwords, not total number of passwords

    [*] Length:
    [+]                         8: 20% (2966037)
    [+]                         7: 17% (2506271)
    [+]                         9: 15% (2191039)
    [+]                        10: 14% (2013695)
    [+]                         6: 13% (1947798)
    ...

    [*] Character-set:
    [+]             loweralphanum: 42% (6074867)
    [+]                loweralpha: 25% (3726129)
    [+]                   numeric: 16% (2346744)
    [+]      loweralphaspecialnum: 02% (426353)
    [+]             upperalphanum: 02% (407431)
    ...

    [*] Password complexity:
    [+]                     digit: min(0) max(255)
    [+]                     lower: min(0) max(255)
    [+]                     upper: min(0) max(187)
    [+]                   special: min(0) max(255)

    [*] Simple Masks:
    [+]               stringdigit: 37% (5339556)
    [+]                    string: 28% (4115314)
    [+]                     digit: 16% (2346744)
    [+]               digitstring: 04% (663951)
    [+]                 othermask: 04% (576324)
    ...

    [*] Advanced Masks:
    [+]          ?l?l?l?l?l?l?l?l: 04% (687991)
    [+]              ?l?l?l?l?l?l: 04% (601152)
    [+]            ?l?l?l?l?l?l?l: 04% (585013)
    [+]        ?l?l?l?l?l?l?l?l?l: 03% (516830)
    [+]            ?d?d?d?d?d?d?d: 03% (487429)








		

				

				

				

					

			

		

				

				

				

						

					

			

								

				

			
		

				

				

				

			
		

				

				

				

			
		

				

					

		

							

		

				

				

					

							

					CIP Cyber Staff
				

			
			

									

						

							CIP Cyber Staff						

					

				
									

						CIP Cyber Staff comprises CIP cybersecurity experts committed to delivering comprehensive information on critical infrastructure protection. The content covers diverse topics, equipping professionals to defend organizations and communities in an ever-evolving cyber landscape.					

				
							

		

				

				

					

		

				

			

								

				

			
Most popular
		

				

				

				

			
		

									

						

					

			

								

				

			
Opinion
		

				

				

				

			
Password Cyberattack: Everything You Need to Know
		

				

				

				

			
November 7, 2023
		

				

					

		

				

			

								

				

																
															
															

				

					

		

							

		

							

		
		

									

						

					

			

								

				

			
Industrial Cybersecurity
		

				

				

				

			
Cybersecurity Awareness Month: Spotlight on ICS/OT Security
		

				

				

				

			
September 28, 2023
		

				

					

		

				

			

								

				

																
															
															

				

					

		

							

		

							

		
		

									

						

					

			

								

				

			
Opinion
		

				

				

				

			
How to Protect IoT Devices in Critical Infrastructure Networks
		

				

				

				

			
September 15, 2023
		

				

					

		

				

			

								

				

																
															
															

				

					

		

							

		

							

		
		

				

				

						

					

			

								

				

							
Want always be up to date?
						

				

				

				

			
Don't miss the latest news
		

				

				

				

							
By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.
						

				

				

				

					

			
			
			

							
			
			

								

												
														
											

								

													
											

								

					
				

			

		

				

				

					

		

							

		

				

							

							

					

			

								

				

			
CIP Training & Certifications
		

				

				

				

							
Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings
						

				

				

				

					

			
						
							
							
						Choose Training
		
					
		

				

				

					

		

							

		

					

		

							

		

				

						

					

			

								

				

			
Related Articles
		

				

				

				

					

				

			

				

				

			
				Password Cracking Tutorial, Tips & Techniques			
		

				

			
This article covers password cracking and hacking topics, including dictionary-based attacks, brute-force attacks, and rainbow table attacks. It also demonstrates various password cracking techniques by

		

				

				

					
			August 24, 2021		
				

					

		

				
				
				

		
				

				

					

		

							

		

				

						

					

			

								

						

					

			

								

				

							
Want always be up to date?
						

				

				

				

			
Don't miss the latest news
		

				

				

				

							
By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.
						

				

				

				

					

			
			
			

							
			
			

								

												
														
											

								

													
											

								

					
				

			

		

				

				

					

		

				

			

									

		

							

		

				

							

							

					

			

								

				

			
CIP Training & Certifications
		

				

				

				

							
Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings
						

				

				

				

					

			
						
							
							
						Choose Training