Python Brute forcing (Very basic)

Question

I've just started learning python and i'm trying to create a small brute force program that will ask for an input from the user (password), brute force it then check if it matches. My problem: I am stuck in the computation of the loop (as you'll see in the source code)

Thanks for your help.

Source code:

L1=['a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z']

L2=['A','B','C','D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z']

L3=['0','1','2','3','4','5','6','7','8','9']

L4=L1+L2+L3

user=input("Enter your secret password here (maximum 4 characters): ")

sum=""


for i in range(0,len(L4)):

    sum=L4[i]+L4[i+1]

    print(sum)

    if sum==user:

        print("your cracked password is :", sum)

        break;

Instead of writing the alphabets and the digits, use `string.ascii_uppercase`, `string.ascii_lowercase` and `string.digits`. — Sukrit Kalra, Jun 12 '13 at 11:41
You are comparing `sum==user`, but sum has always 2 characters (`sum = L4[i] + L4[i+1]`) while `user` can have up to 4... Something wrong? — E.Z., Jun 12 '13 at 11:41
You need to generate all the permutations of `L4`, try reading about `itertools.permutations` and then try implementing it. — Sukrit Kalra, Jun 12 '13 at 11:50

Ashwini Chaudhary · Accepted Answer · 2013-06-12T12:00:53.973

4

You can use itertools.product here:

>>> from string import letters, digits
>>> strs = letters + digits
>>> from itertools import product
def pwd_checker(pwd):
    if 0 <len(pwd) <5:
       for i in xrange(1,5):
           for per in product(strs, repeat = i):
               if "".join(per) == pwd:
                  print 'your password is', "".join(per)
                  return
    else:
       print "Password's length must be between 1 to 4"
...             
>>> pwd_checker('a')
your password is a
>>> pwd_checker('ab12')
your password is ab12
>>> pwd_checker('foo')
your password is foo
>>> pwd_checker('Ab1c')
your password is Ab1c
>>> pwd_checker('aaaa')
your password is aaaa
>>> pwd_checker('BaBa')
your password is BaBa

edited Jun 12 '13 at 12:00

answered Jun 12 '13 at 11:44

Ashwini Chaudhary

244,495
58
464
504

You could use `ascii_letters` instead of `ascii_lowercase` and `ascii_uppercase` – mgilson Jun 12 '13 at 11:45
2

Also, for what it's worth, this doesn't work if the user's password is only 3 characters long. – mgilson Jun 12 '13 at 11:46
1

it should be combinations_with_replacement() as permutation prohibit repetition and you should test for 1, 2 and 3 chars length – Samy Arous Jun 12 '13 at 11:47
1

@lcfseth itertools.product is required here. – Ashwini Chaudhary Jun 12 '13 at 11:59
@mgilson missed that specification, fixed the solution. – Ashwini Chaudhary Jun 12 '13 at 12:00

score 3 · Answer 2 · answered Jun 12 '13 at 11:59

3

Tthis is a list of all possible passwords:

list(itertools.chain(
   *[map(lambda x: ''.join(x), itertools.product(L4, repeat=i)) for i in range(5)])
)

You can loop through it or use find (and catch ValueError)

answered Jun 12 '13 at 11:59

Karoly Horvath

94,607
11
117
176

Samy Arous · Answer 3 · 2013-06-12T11:54:34.663

2

let's say a password can only contain elements for L4=L1+L2+L3 and let's assume that is has a fixed length l.

this password is a combination with repetition of l elements from the set L4.

your brute force algo should then generate every combination with repetition of 1,2, 3 and 4 elements from the set L4.

you can do this easily using itertools

import itertools
for l in xrange(4):
    for try_ in itertools.product(L4, repeat=l + 1):
        if ''.join(try_) == user:
            print("your cracked password is :", try_)
            return

It would be interesting to implement yourself the combinations_with_replacement function which can be easily done using either recursivity or a stack :)

edited Jun 12 '13 at 11:54

answered Jun 12 '13 at 11:46

Samy Arous

6,794
13
20

Don't use `try` as a variable name! – Sukrit Kalra Jun 12 '13 at 11:48
^^. `try` is a keyword, remember ;) – TerryA Jun 12 '13 at 11:49
1

Seems like the `try`s are all sorted, i.e., "DCBA" will never be tested. – tobias_k Jun 12 '13 at 11:50
1

You need `itertools.product(L4, repeat=l + 1)`. – Sven Marnach Jun 12 '13 at 11:52
Yeah, I didn't want to use product, but I didn't know about the sorted thing :) best to use product, indeed – Samy Arous Jun 12 '13 at 11:54
This is a community answer :p We should all share the reward :) – Samy Arous Jun 12 '13 at 11:57

score 0 · Answer 4 · answered Jun 12 '13 at 11:49

I'd go for the itertools solution for a production ready code.

But if you want to learn and code your own implementation:

after a simple googling, here's a permutation algorithm you could look up and try to reimplement in python with strings instead of numbers.

Python Brute forcing (Very basic)

4 Answers4