Active
Project:
Drop the Ripper
Version:
2.0.x-dev
Component:
Code
Priority:
Normal
Category:
Feature request
Assigned:
Unassigned
Reporter:
Created:
18 Jun 2021 at 10:35 UTC
Updated:
22 Aug 2023 at 08:58 UTC
Jump to comment: Most recent
Problem/Motivation
DtR has a wordlist of common bad passwords which it tries, but it also makes a few guesses at user passwords based on the simple info available about the account e.g.
https://git.drupalcode.org/project/drop_the_ripper/-/blob/2.0.x/Commands...
https://git.drupalcode.org/project/drop_the_ripper/-/blob/2.0.x/drop_the...
/**
* Make a few guesses about a user's password.
*
* @param object $user
* A (basic) user object.
*
* @return array
* Guesses at the user's password.
*/
function _dtr_user_guesses($user) {
$guesses = array();
$guesses[] = $user->name;
$guesses[] = $user->name . date('Y');
$guesses[] = $user->mail;
if (preg_match('/(.*)@(.*)\..*/', $user->mail, $matches)) {
// Username portion of mail.
$guesses[] = $matches[1];
// First part of domain.
$guesses[] = $matches[2];
}
return array_unique(array_filter($guesses));
}
I've seen these be correct surprisingly often.
What other guesses might we try?
I've been meaning to add $user->name . (date('Y') -1); for a while...
I think I'd like to keep the number of guesses fairly low but a few more wouldn't hurt.
For example probably not a brute force approach adding digits to the username, although perhaps that's not such a terrible idea as an option?
There's already the --no-guessing option to disable guessing if someone wants to do that for any reason.
Comments
Comment #2
mcdruid commentedComment #3
mcdruid commentedComment #4
mcdruid commentedComment #5
mcdruid commentedI think trying a few sequential digits on the end of the username is worth a shot.
It's hard to come up with really good metrics for how common these things are, but looking at rockyou gives us a rough idea.
IIUC how high up the wordlist a given password comes reflects how common it was in the breach, so smaller numbers on the left means the password was more popular:
This is not very scientific but I'm going to take that to mean it's not really worth going further than 123.
It wouldn't be hard to add all of these suffixes, but that goes against the idea of keeping the number of guesses low.
I'm somewhat inclined to only add "1" and "123" as "12" doesn't seem as popular.
Getting even less scientific I think I'll add an exclamation mark suffix as this is anecdotally popular, and a basic check against other special characters bears this out (a couple of nasty words redacted in the results):
I think I'll leave it at that as I don't want to add a lot of extra guesses.
Perhaps at some point we could add another option to add a load of patterns based on popular rules / patterns used by John the Ripper / HashCat etc..
Drop the Ripper has the advantage this it knows some info about the user already e.g. username, mail so we're in quite a good position to try a couple of basic variations.
Comment #7
mcdruid commentedI've not added to the tests to check the new guesses.
Leaving this open for that if nothing else.