Rust-based password mutator for brute force attacks

Last update: Jun 9, 2022

PWFuzz-RS

A Rust-based password mutator for brute force attacks

Disclaimer

This tool works, but was mainly an experiment. Please do not expect frequent updates to it.

About

So you're brute-forcing a web app or other target. Sure you have a wordlist, maybe even a large one, but what about variations? Tossing ! or year numbers on there? Adding random numbers? It would be great to have an easy way to mutate existing password lists to add variations. Hashcat has rule-based attacks, but what about for non-hash passwords?

That's what pwfuzz-rs is about.

Installation

There are binaries available for Linux and Windows over on Releases.

You can of course build from source, but hey, it's a Rust tool, so you can also just cargo install pwfuzz-rs!

Usage

pwfuzz-rs -w wordlist.txt -r rules.json [-i iterations]

pwfuzz-rs accepts the following arguments:

  • -w --wordlist: Path to wordlist
  • -r --rules-file: Path to JSON rules file
  • -i --iterations: Number of iterations to run mutations
  • -h --help: Help

The output will be to stdout, but you can use any Unix tool you like to redirect it!

Rules

Let's talk about Rules.

pwfuzz-rs supports the following rules:

  • Append [string]: Append the given string
  • Prepend [string]: Append the given string
  • Upper: Uppercase the word
  • Lower: Lowercase the word
  • Insert [string] [idx]: Insert the given string and index idx (Skips on index failure)
  • AppendRandom [range]: Append a random number from 0-range
  • Prepend [range]: Append a random number from 0-range

The Rules File

The Rules Files is a JSON file that expects an author key and a rules key. This example shows all rule variants.

{
    "author": "Your Name <Your Email>",
    "rules": [
        {
            "Append": "!"
        },
        {
            "Prepend": "1"
        },
        "Upper", // no args means no object needed
        "Lower",
        {
            "Insert": ["%", 4] // inserts "%" at index 4
        },
        {
            "AppendRandom": 100
        },
        {
            "PrependRandom": 100
        }
    ]
}

Given the list:

letmein
iamgod
password

These rules produce:

letmein
iamgod
password
letmein!
iamgod!
password!
1letmein
1iamgod
1password
LETMEIN
IAMGOD
PASSWORD
letmein
iamgod
password
letm%ein
iamg%od
pass%word
letmein20
iamgod17
password79
18letmein
97iamgod
65password

Iterations

But what if we want to apply rules on rules on rules on rules?

I got you, fam.

Passing -i allows you to iteratively apply rules to newly-generated mutations. So if we pass -i 3 to the above list, we get 1500 unique passwords!

GitHub

https://github.com/mttaggart/pwfuzz-rs
You might also like...

🐴 RusTOTPony — CLI manager of one-time password generators aka Google Authenticator

🐴 RusTOTPony CLI manager of time-based one-time password generators. It is a desktop alternative for Google Authenticator. Installation Arch Linux Pa

Jun 10, 2022

A safe implementation of the secure remote password authentication and key-exchange protocol (SRP), SRP6a and legacy are as features available.

Secure Remote Password (SRP 6 / 6a) A safe implementation of the secure remote password authentication and key-exchange protocol (SRP version 6a). Ver

Jun 1, 2022

A password entropy calculator.

paspio — pasvorta entropio A (naive) password entropy calculator. Refrain from using this as a sole measure of password strength, it should be used in

Mar 8, 2022

Password-Authenticated Key Agreement protocols

RustCrypto: PAKEs Password-Authenticated Key Agreement protocols implementation. Warnings Crates in this repository have not yet received any formal c

May 30, 2022

Password hashing functions / KDFs

RustCrypto: Password Hashes Collection of password hashing algorithms, otherwise known as password-based key derivation functions, written in pure Rus

Jun 20, 2022

Rest API to check if a password is in a data breach

easypwned (haveibeenpwned / HIBP) Rest API to check if a password is in a data breach. Works offline - everything stays on your machine! Database is i

Mar 16, 2022

The free password manager for power users

The free password manager for power users

The free password manager for power users

Jun 2, 2022

A Secure Capability-Based Runtime for JavaScript Based on Deno

A Secure Capability-Based Runtime for JavaScript Based on Deno

Secure Runtime secure-runtime, as the name implies, is a secure runtime for JavaScript, designed for the multi-tenant serverless environment. It is an

May 24, 2022

rabe is an Attribute Based Encryption library, written in Rust

Rabe rabe is a rust library implementing several Attribute Based Encryption (ABE) schemes using a modified version of the bn library of zcash (type-3

May 22, 2022
Comments
  • 1. Satisfy clippy, and some other housekeeping

    Just a few clean-ups:

    • Removal of unused imports
    • &String to &str for function parameters
    • Removed unreachable code (enum was fully covered, so the _ case is never possible)
    • Replace single character string literal with char
    • Remove immediately dereferenced references in apply and push_str calls
    • Changed path: String to path: P where P: AsRef<Path>

    Not Done

    • Any revisions to Cargo.toml for
      • Version
      • Authorship
    • Programmatic tests (though I did run the example without issue). I may write unit tests later if you're interested
    Reviewed by anthonyjmartinez at 2022-06-03 03:46
A mnemonic brute forcing tool for nano and banano.

brute a mnemonic brute forcing tool for nano and banano. What is brute? It is a mnemonic brute forcing tool which can be used to recover an account fr

May 3, 2022
Ruo is a dictionary-based password cracker written in rust 🦀 .

Ruo is a dictionary-based password cracker written in rust ?? . The primary purpose is to crack weak hashes/commonly used passwords.

Mar 6, 2022
Master Password in Pure Rust
Master Password in Pure Rust

Master Password •••| This is the Rust version of the original found here. This can be used as a drop-in replacement for the reference C version, offer

Apr 13, 2022
A Rust port of the password primitives used in Django Project.

Rust DjangoHashers A Rust port of the password primitives used in Django Project. Django's django.contrib.auth.models.User class has a few methods to

Jun 8, 2022
The simple password manager for geeks, built with Rust.

Rooster Rooster is a simple password manager for geeks (it works in the terminal). Rooster is made available free of charge. You can support its devel

Jun 8, 2022
A simple password manager written in rust

Passman - A password manager written in rust. How to use?: USAGE: passman option Currently available options are: new - initalize passman with a new m

Aug 26, 2021
A simple password manager written in Rust
A simple password manager written in Rust

ripasso A simple password manager written in Rust. The root crate ripasso is a library for accessing and decrypting passwords stored in pass format (G

Jun 17, 2022
A password manager coded in rust

pasman A password manager coded in rust Install Dependency rust Shell git clone https://github.com/AMTitan/pasman.git cd pasman cargo build --release

Nov 8, 2021
A Rust port of the password primitives used in Django Project.

Rust DjangoHashers A Rust port of the password primitives used in Django Project. Django's django.contrib.auth.models.User class has a few methods to

Jun 8, 2022
An implementation of the OPAQUE password-authenticated key exchange protocol

The OPAQUE key exchange protocol OPAQUE is an asymmetric password-authenticated key exchange protocol. It allows a client to authenticate to a server

Jun 9, 2022