Giter VIP home page Giter VIP logo

chasm's Introduction

CH.A.S.M.

CHaracter Aware Split Method

The main idea behind Chasm is to reuse password patterns in a way that is likely to produce probable password candidates.

So how does this work?

chasm1 chasm2 chasm3 chasm4

Requirements

  • libjudy
    On debian based systems use:
    $ sudo apt install libjudy-dev

Building

$ make
Or get the precompiled binaries. They are statically linked against libjudy.

Chasm usage

$ chasm -l 30 -k 2 out/chasm < dictionary.txt

Some user definable options that Chasm supports:

  • -a (Analyze frequency, will output the frequency of the split part)
  • -c Create rules for dictionary attack eg left-side becomes prefix rules ^ conversely right-side becomes $ suffix rules
  • -s Sort by frequency, highest first
  • -o [charcode] Only splits if the split character matches the character code, eg -o 101 will only split on the letter 'e' at the defined midpoint/range
  • -l [string len] Will not split if the length of the input string if greater than this number -l 20 will skip all strings greater than length 20.
  • -k [min occurance] Will not write splits where occurrence is less than defined occurrence -k 2 will not output splits which only occur once
  • -m [mid point] Instead of splitting the string in half (len/2) you can specify a position to perform the split on
  • -r [number] Will split X chars around the middle including the middle, X denotes how far you want to branch out

chasm's People

Contributors

hops avatar winxp5421 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

chasm's Issues

Add maximum candidates option

Is it possible to add a command line option to output only the first N words?
It is useful for example for speed benchmarking.
Thanks 😀

feature request: split/tokenize on change in character class

Given this input:

PassWord123!@#пароль

... it would be great to be able to optionally generate at least one of the following sets of output, treating the "boundary" between changes in character class as the split point, optionally case-sensitive, case-insensitive, (or both):

P,ass,W,ord,123,!@#,пароль
Pass,Word,123,!@#,пароль

... resulting in the following superset of output strings:

!@#
123
P
Pass
W
Word
ass
ord
пароль

In the simplest case, all non-ASCII could be handled as an entirely separate class, and in a later revision, checked for case and class - similar to Perl's \p character classes:

\p{Number}
\p{Letter}
\p{Upper}
\p{Lower}
\p{Mark}
\p[Punctuation}
\p{Symbol}

I've been referring to this concept of splitting on character-class boundary as "tokenization", and I've been doing it with the Perl \p classes, but I suspect that there's a lot of room for more efficiency by doing it within chasm (and being able to combine it with other chasm options).

clarify usage help and behavior

Would be good to clarify which cmdline parameters are mutually exclusive, which perform primary actions, which augment the functionality of a primary action, etc. Grouping them into primary and then modifier subgroups would be good, and then sorting each of those sections alphabetically (in compressed manpage style).

Would also be good if -t mentioned that the resulting filename has '.tokens' appended. I assumed that I'd be supplying the filename entirely, so I got a 'blah.tokens.tokens' output filename. :) I see the basefilename in the usage output, but explicitly mentioning "this flag will append '.tokens' to the basefilename" or something like that would be good.

A "chasm: a CHaracter Aware Splitting Method for producing password candidates" line at the top of the usage output is customary.

-s and -t appear to be mutually exclusive - requesting -s with -t has no effect on the output order. Naively, I would expect -s to modify -t, so that I could get a frequency-ordered list. (I'd also like that frequency order to include the frequency count itself, if I had my druthers.)

The overall burden necessary for new users to understand the output could use a little reduction. For example, the usage output should describe the scheme used to name the output files.

It also seems counterintuitive for the default behavior to be to create a bunch of output files.

More-specific usage feedback would be useful. For example, if the basefilename is omitted, prior to printing usage, an "error: basefilename not specified" would help new users.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.