PACK – Password Analysis & Cracking Toolkit

PACK (Password Analysis and Cracking Toolkit) is a collection of utilities developed to aid in analysis of password lists in order to enhance password cracking through pattern detection of masks, rules, character-sets and other password characteristics. The toolkit generates valid input files for Hashcat family of password crackers.








Before we can begin using the toolkit we must establish a selection criteria of password lists. Since we are looking to analyze the way people create their passwords, we must obtain as large of a sample of leaked passwords as possible. One such excellent list is based on RockYou.com compromise. This list both provides large and diverse enough collection that provides a good results for common passwords used by similar sites (e.g. social networking). The analysis obtained from this list may not work for organizations with specific password policies. As such, selecting sample input should be as close to your target as possible. In addition, try to avoid obtaining lists based on already cracked passwords as it will generate statistics bias of rules and masks used by individual(s) cracking the list and not actual users.

The most basic analysis that you can perform is simply obtaining most common length, character-set and other characteristics of passwords in the provided list. In the example below, we will use ‘rockyou.txt’ containing approximately 14 million passwords. Launch statsgen.py with the following command line:

$ python statsgen.py rockyou.txt

                           _
         StatsGen #.#.#   | |
          _ __   __ _  ___| | _
         | '_  / _` |/ __| |/ /
         | |_) | (_| | (__|   < 
         | .__/ __,_|___|_|_
         | |                    
         |_| [email protected]

    [*] Analyzing passwords in [rockyou.txt]
    [+] Analyzing 100% (14344390/14344390) of passwords
        NOTE: Statistics below is relative to the number of analyzed passwords, not total number of passwords

    [*] Length:
    [+]                         8: 20% (2966037)
    [+]                         7: 17% (2506271)
    [+]                         9: 15% (2191039)
    [+]                        10: 14% (2013695)
    [+]                         6: 13% (1947798)
    ...

    [*] Character-set:
    [+]             loweralphanum: 42% (6074867)
    [+]                loweralpha: 25% (3726129)
    [+]                   numeric: 16% (2346744)
    [+]      loweralphaspecialnum: 02% (426353)
    [+]             upperalphanum: 02% (407431)
    ...

    [*] Password complexity:
    [+]                     digit: min(0) max(255)
    [+]                     lower: min(0) max(255)
    [+]                     upper: min(0) max(187)
    [+]                   special: min(0) max(255)

    [*] Simple Masks:
    [+]               stringdigit: 37% (5339556)
    [+]                    string: 28% (4115314)
    [+]                     digit: 16% (2346744)
    [+]               digitstring: 04% (663951)
    [+]                 othermask: 04% (576324)
    ...

    [*] Advanced Masks:
    [+]          ?l?l?l?l?l?l?l?l: 04% (687991)
    [+]              ?l?l?l?l?l?l: 04% (601152)
    [+]            ?l?l?l?l?l?l?l: 04% (585013)
    [+]        ?l?l?l?l?l?l?l?l?l: 03% (516830)
    [+]            ?d?d?d?d?d?d?d: 03% (487429)



Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

Top 10 things to Do After Installing Kali Linux

Kali Linux is considered to be one of the best hacking distribution of this era, it is developed by Offensive Security to give an...

Become a spy in your own right with Xnspy Android spying app

Having become widely popular among parents and employers, spying apps have become quite the norm nowadays. Android spying apps have made it a lot...

e-Services Portals Potentially Expose Government Infrastructure to File-based Attacks

More and more users are embracing technology to perform their day-to-day activities. It’s not only private businesses that are forced to establish digital channels...

What is Nmap? How to use Nmap for Information Gathering

Nmap stands for Network Mapper, a powerful network scanning and host detection tool that is being used to perform reconnaissance in a very first...