0

Good afternoon,

Im very new to python coding and Im trying to write a very basic md5 brute force password cracker for a school project.

I am supposed to write a script that will crack a series of MD5 hashed passwords. The passwords must be read in from a text file named “hashes.txt”, with one password on every line. The script should then start generating passwords, starting with single character, and then two characters, etc

My thought process of how to make a brute force cracker is as follows:

import hashlib
import itertools
abc = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@0123456789"
abc_list = list(abc)

def combo():
    md5_hash = ""
    file_name = open("hashes.txt", "r")
    for password in file_name:
        password = password.strip()
        #print(password)
        for r in range(len(abc_list)):
            combinations_object = itertools.combinations(abc_list, r)
            combinations_list = list(combinations_object)
            #print(combinations_list)
            for lis in combinations_list:
                glue = "".join(lis)
                hash_object = hashlib.md5(glue.encode())
                md5_hash = hash_object.hexdigest()
                print(glue)
                #print(md5_hash)
                #print(glue + " " + md5_hash)
                if md5_hash == password :
                    print("Your password is: " + "'" + glue +"' "+ md5_hash)
                    break

The passwords I am given to crack are: Z, AD, God, 1234, AbCdE, Trojan

Every time I run the script it only outputs the password: Z and then runs through the rest without fulfilling the 'if' statement.

I have tried using the 'break' statement under the 'if' but the outcome is the same.

Obito
  • 1
  • 1
  • You might consider putting your `for r` loop into a separate function, so you can just `return` when you make a hit. Otherwise, you'll need to add a `found` variable. Set `found` to False, then when you find a hit set `found = True`, then just after the inner `for` loop do `if found: break`. – Tim Roberts Nov 25 '21 at 23:16
  • 1
    You don't need to convert the combinations to a list if you're only going to use it in a `for` loop. You certainly don't want to create a list once you get to longer lists; the list will be way too large. – Tim Roberts Nov 25 '21 at 23:18
  • @TimRoberts No "need" for a `found` variable, can also be done with else/continue/break. – Kelly Bundy Nov 25 '21 at 23:33
  • @KellyBundy I disagree. You can `break` from the innermost loop, but somehow you need a signal to exit the middle loop. That's going to require additional state. – Tim Roberts Nov 26 '21 at 04:34
  • @TimRoberts [That `break` is signal enough](https://tio.run/##bVLZTsMwEHzPVyx@ia1WEVDOSpUolPu@j5cqh9O4Texgu7Tw88UuIQ2k@@A48szs7mjyT50I3trJ5WzGslxIDYmvkpQFTvHLNJVaiFQ5fhBCB5D5RDQeJGw4SjMu8nep9PhjMv386u4f9A6Pjk9Oz84vLq@ub27v7h8en55fXt9W9lbX1lsbm1vbO7vIcQwfQpEFApO2A6ZiltI@9zNqGoiccozsFFR5eqpRE5BE5AcnJOS@UhMhI2B8wfuRsVU@d8qrp7RkOSYlxspIy5c@H1CcmoZmK0IWKr@olCmLK03w7NiM@5oJriypCfIfzdYgHdtVEPKGgnFsVEgNYzfsi2BIQ22gheteFm1iy/YoD0VEMakTDaRv4QWr0PASOo3YgCqN6xQWV1gLY6A@@dxCybjG6FWMq26rNiBoAHLtOV@wgVxAjVKZLBULJPVHf15oqmi9cSi4ZnxMnTrZmTCdLM3FBBHwFcTtpelw39wmuN2ePW383EpK5itWTS/DUhpfdbQ5j1onJk6R29nsGw). – Kelly Bundy Nov 26 '21 at 04:40

2 Answers2

1

You might benefit from creating and storing the combinations list once (or rather, a generator).

https://stackoverflow.com/a/31474532/11170573

import itertools

def all_combinations(any_list):
    return itertools.chain.from_iterable(
        itertools.combinations(any_list, i + 1)
        for i in range(len(any_list)))

You can change the code as follows:

import hashlib
import itertools
abc = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@0123456789"
abc_list = list(abc)

combinations_object = all_combinations(abc_list)

def combo():
    file_name = open("hashes.txt", "r")
    for password in file_name:
        password = password.strip()
        for comb in combinations_object:
            glue = "".join(comb)
            hash_object = hashlib.md5(glue.encode())
            md5_hash = hash_object.hexdigest()
            if md5_hash == password :
                    print("Your password is: " + "'" + glue +"' "+ md5_hash)
                    break
Vandan Adhvaryu
  • 21
  • 4
0

When you use break, what you are saying is break the loop I'm currently in.

Notice that your condition is wrapped by three for loops, so it will only break the inner inner loop and keep going with the rest.

What you can do is what Jason Baker sugests in https://stackoverflow.com/a/438869/16627440.

Change that break to return md5_hash and call the function in your print.

if md5_hash == password :
    return md5_hash

# Outside your function
print("Your password is: " + "'" + glue +"' "+ combo())
rookie
  • 126
  • 10