(12-26-2019, 03:45 AM)royce Wrote: Most of what you're looking to do can be accomplished with the PACK toolkit:
https://github.com/iphelix/pack
The 'policygen' tool can help generate masks with arbitrary policies (and they won't overlap):
https://github.com/iphelix/pack/blob/mas...licygen.py
As to sorting them by likely frequency, that can also be accomplished against a given corpus using the 'statsgen' tool. Whether the stats from one corpus are useful against another corpus depends on the situation, YMMV, science it up.
Thanks, that was super useful! The only thing that I couldn't find within these programs is the ability to select custom mask types from masks generated from a file. For example, if I use statsgen with rockyou.txt, it outputs the best masks regarding that file, but I couldn't find a way to implement a filter to it like PolicyGen implements. By that I mean, "look for the best masks in this file that follow these policies". But considering that is relatively easy to implement, I did a simple python code that does exactly that, if anyone is interested. Just change the input/output file names to wathever suits you best.
EDIT: Just found out unfortunately I can't attach python programs, oh well. If anyone is interested, and it is within the rules, I can provide a github link for it or something, just message me.
As a last note, I bring again a topic I briefly discussed in my initial comment: is there any possibility or experimentation of implementing some kind of "mask-merging" feature? By that I mean, let's say there are two masks ordered by MaskGenerator:
1- ?l?l?l?l
2 - ?d?d?d?d
If I run an analysis like this, all the possibilities from mask 1 will be tried before touching mask 2. But it is logical that 1234 is more likely to be the true password than xzwk. It would be amazing if there could be some sort of ranking of possibilities within all the possibilities of all the masks combined, then run the analysis on this entire list at once, ignoring the mask order list. I do understand that this seems REALLY complex and maybe that's why this feature isn't out there yet. But it'd be awesome if it did exist.