Release 0.3.0 James Knoblauch - Read the Docs · randstrs Documentation, Release 0.3.0 Wordlist Source Options: Choose options for wordlist sources.--import PATH Import a wordlist

randstrs DocumentationRelease 0.3.0

James Knoblauch

March 26, 2013

CONTENTS

1 User Documentation 31.1 listgen.py . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31.2 passgen.py . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101.3 passtest.py . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

2 API 232.1 Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232.2 Indices and tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

3 Resources 413.1 Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413.2 Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

4 Indices and tables 43

Python Module Index 45

i

ii

randstrs Documentation, Release 0.3.0

Contents:

CONTENTS 1


2 CONTENTS

CHAPTER

ONE

USER DOCUMENTATION

1.1 listgen.py

This script is used to generate and manipulate wordlists, which can then be used to generate passphrases via pass-gen.py. You can generate lists from a variety of sources, including plain text and web pages. You can also manipulateexisting lists in a variety of ways.

Table of Contents

• listgen.py– Command Line Options– Usage Examples

* Generate a wordlist from text:* Manipulating wordlists* Importing wordlists* Merging wordlists

1.1.1 Command Line Options

usage: listgen.py [-h] [-v] [-V] [--import PATH] [--export PATH][--gen-from-text TEXT][--gen-from-num-range [INTEGER [INTEGER ...]]][--gen-from-web [URL [URL ...]]][--gen-from-web-random [URL [URL ...]]][--wordcount INTEGER] [--minlen INTEGER] [--maxlen INTEGER][--rm-dupes] [--rm-chars STRING][--rm-words [WORD [WORD ...]]] [--upper-words][--lower-words] [--clean] [--sort] [--shuffle][--merge [PATH [PATH ...]]] [--lpad CHARS] [--rpad CHARS][-T] [-c STRING] [-U] [-L] [-D] [-P] [-A]

optional arguments:-h, --help show this help message and exit

General Options:General options.

-v, --version-V, --verbose Verbose output. (default: False)

3


Wordlist Source Options:Choose options for wordlist sources.

--import PATH Import a wordlist from a text file. (default: None)--export PATH Export a wordlist to a text file. (default: None)--gen-from-text TEXT Generate a wordlist from text. (If input is file, get

text from file.) (default: None)--gen-from-num-range [INTEGER [INTEGER ...]]

Generate a list from a range of numbers, with optionalpadding characters. Usage: --num-range [START] [STOP][PADCHAR] [DIGITS] ex. --num-range 1 100 0 3 (default:None)

--gen-from-web [URL [URL ...]]Generate a wordlist from one or more web pages,combined. (If input is file, get URLs from file.)(default: None)

--gen-from-web-random [URL [URL ...]]Select a random site from a list of urls and generatea wordlist from that site. (If input is file, get URLsfrom file.) (default: None)

Wordlist Manipulation Options:Choose options for wordlist manipulation.

--wordcount INTEGER Desired number of words. (Only works when sourcescontain enough words.) (default: None)

--minlen INTEGER Minimum word length. (default: None)--maxlen INTEGER Maximum word length. (default: None)--rm-dupes Remove duplicate words. (default: False)--rm-chars STRING Remove chosen characters from each word in the

wordlist. (default: None)--replace-chars STRING STRING

Replace chosen characters from each word in thewordlist.Usage: --replace-chars [OLDCHARS] [NEWCHARS](default: None)

--rm-words [WORD [WORD ...]]Remove chosen words from the wordlist. (If input isfile, get words from file.) (default: None)

--upper-words Make all words uppercase. (default: False)--lower-words Make all words lowercase. (default: False)--clean Clean list. Change all words to lowercase and remove

duplicates. (default: False)--sort Sort a list in alphabetical order. (default: False)--shuffle Randomize a list. (default: False)--merge [PATH [PATH ...]]

Merge multiple wordlists. (default: None)--lpad CHARS Left pad words with the chosen characters. (default: )--rpad CHARS Right pad words with the chosen characters. (default:

)

Character Set Options:Choose which characters to include as individual words in the wordlist.

-c STRING, --chars STRINGAdd characters to character pool. (default: None)

-U, --upper Include all uppercase letters in character pool.(default: False)

-L, --lower Include all lowercase letters in character pool.

4 Chapter 1. User Documentation


(default: False)-D, --digits Include all digits in character pool. (default: False)-P, --punctuation Include all punctuation characters in character pool.

(default: False)-A, --all Include all characters in character pool. (Uppercase,

Lowercase, Digits, and Punctuation) (default: False)

1.1.2 Usage Examples

Generate a wordlist from text:

You can create a wordlist from text by using the --gen-from-text option. The input text can be either a string oftext, or a text file containing text.

By default the resulting wordlist will be printed to the screen, but you can save it by using the --export option.

The following command will create a wordlist named wordlist.txt from a text file named textfile.txt:

$ listgen.py --gen-from-text textfile.txt --export wordlist.txt

If textfile.txt contained the following text:

Sing, O goddess, the anger of Achilles son of Peleus, that broughtcountless ills upon the Achaeans.

Then the resulting wordlist would contain the following:,,,SingOgoddesstheangerofAchillessonofPeleusthatbrought.countlessillsupontheAchaeans

Note: Special characters are included as individual words by default.

Note: You can also replace textfile.txt with a quoted string of text, like this:

$ listgen.py --gen-from-text "Sing, O goddess, the anger of Achilles..." --export wordlist.txt

1.1. listgen.py 5


Manipulating wordlists

As you can see, duplicate words are not removed, and no sorting is done by default. You can use the --rm-dupesoption to remove duplicate words. Use the --sort option to sort the words:

$ listgen.py --gen-from-text textfile.txt --export wordlist.txt --rm-dupes --sort

This would give you the following output:,.AchaeansAchillesOPeleusSingangerbroughtcountlessgoddessillsofsonthattheupon

Note: Items are sorted in this order:

1. Whitespace Characters (space, tab, etc.)

2. Special Characters (!, @, #, etc.)

3. Numbers (0-9)

4. Upper Case (A-Z)

5. Lower Case (a-z)

There are many other options for manipulating wordlists.

If you want to add certain characters as words in your list, you can use the Character Set options. For example, to addall of the digit characters, use the -D option:

$ listgen.py --gen-from-text textfile.txt --export wordlist.txt --rm-dupes --sort -D

Output:,.0123456789Achaeans



AchillesOPeleusSingangerbroughtcountlessgoddessillsofsonthattheupon

Importing wordlists

Use the --import option to import an existing wordlist. You can use all of the same manipulation options as youcan when generating a list.

For example, suppose wordlist.txt contained the following:,,,SingOgoddesstheangerofAchillessonofPeleusthatbrought.countlessillsupontheAchaeans

Import it and manipulate it:

$ listgen.py --import wordlist.txt --export wordlist2.txt --minlen 2 --maxlen 4 --lpad %%

Output:

%%Sing%%the%%of%%son%%of%%that%%ills%%upon%%the

1.1. listgen.py 7


Note: With the --minlen or --maxlen options, length selection is performed on the original words, beforepadding takes place with the --lpad option. So the words which are output will not follow the length constraints. Ifyou want length constraints after padding, you will need to run the resulting list through listgen again, using only themin and max length options.

Merging wordlists

To merge multiple wordlists into a single list, use the --merge option.

Let’s merge wordlist.txt:,,,SingOgoddesstheangerofAchillessonofPeleusthatbrought.countlessillsupontheAchaeans

with wordlist2.txt:

%%Sing%%the%%of%%son%%of%%that%%ills%%upon%%the

Command:

$ listgen.py --merge wordlist.txt wordlist2.txt --export wordlist3.txt

wordlist3.txt:,,,SingOgoddess



theangerofAchillessonofPeleusthatbrought.countlessillsupontheAchaeans%%Sing%%the%%of%%son%%of%%that%%ills%%upon%%the

Again, all of the same manipulation options can be used:

$ listgen.py --merge wordlist.txt wordlist2.txt --export wordlist3.txt --rm-chars abcdefg --rm-words the son upon

wordlist3.txt:,,,SinOossthnroAhillsoPlusthtrouht.ountlssillsthAhns%%Sin%%th%%o%%son%%o%%tht%%ills%%upon%%th

1.1. listgen.py 9


1.2 passgen.py

This script can be used to generate random passwords and passphrases.

Table of Contents

• passgen.py– Command Line Options– Usage Examples

* Random Passwords· Generating Random Passwords· Testing Random Passwords

* Pattern-Generated Passwords· Generating Pattern-Based Passwords· Testing Pattern-Based Passwords

* Passphrases· Generating Passphrases· Testing Passphrases

* Testing For “Bad” Passwords


usage: passgen.py [-h] [-v] [-V] [-w] [-p] [-t] [-s PATTERN] [-l INTEGER][-r INTEGER] [-c STRING] [-e STRING] [-U] [-L] [-D] [-P][-A] [--wordlist PATH] [--minlen INTEGER] [--maxlen INTEGER][--test-bad PATH]



-v, --version-V, --verbose Verbose output. (default: False)-w, --password Generate a password. (default: False)-p, --passphrase Generate a passphrase. (Requires a wordlist) (default:

False)-t, --test Test the strength of the generated password. (default:

False)

Password/Passphrase Options:Choose options for password or passphrase generation. Passphrases requirea wordlist, which can be generated from a variety of sources by usinglistgen.py, and imported from a text file.

--pattern PATTERNGenerate a structured password using the chosenpattern. Pattern must be in form: ne:ne:ne:...ne,where n is the number of characters and e is the typeof character. Use d for digits, u for upper case, lfor lower case, p for punctuation, or a for allcharacters. Ex: "-s 2d:1u:3l:2p" would make something



like "45Hksr*$". (default: None)-l INTEGER, --length INTEGER

Length of password to be generated when using--password option. Number of words when using--passphrase option. (default: None)

-r INTEGER, --repeat INTEGERNumber of strings to be generated. (default: 1)

Character Set Options:Choose which characters to include in the character pool.

-c STRING, --chars STRINGAdd characters to character pool. (default: None)

-e STRING, --exclude STRINGExclude characters from character pool. (default:None)

-U, --upper Include all uppercase letters in character pool.(default: False)

-L, --lower Include all lowercase letters in character pool.(default: False)

-D, --digits Include all digits in character pool. (default: False)-P, --punctuation Include all punctuation characters in character pool.

(default: False)-A, --all Include all characters in character pool. (Uppercase,

Lowercase, Digits, and Punctuation) (default: False)

Wordlist Options:Choose options for wordlist imports.

--wordlist PATH Text file containing the wordlist for generating apassphrase. (default: None)

--minlen INTEGER Minimum word length. Words with a length below thisvalue will be excluded from the word pool. (default:None)

--maxlen INTEGER Maximum word length. Words with a length above thisvalue will be excluded from the word pool. (default:None)

Test Options:Choose options for password/passphrase testing.

--test-bad PATH Test password against a list of bad passwords.(default: None)


There are many options for generating passwords. Here are a few examples.

Random Passwords

Generating Random Passwords

Creating a basic random password is quite simple. You’ll need to use the -w option to make a password, supply thelength of the desired password with the -l option, and choose a character pool with one of the character set options

1.2. passgen.py 11


(See Command Line Options). We will be using the -A option to set the character pool to use all printable ASCIIcharacters when generating the password.

Here’s the command for a ten character password, generated from a character pool containing all characters:

$ passgen.py -w -l 10 -A

It will output something like this:

A‘V$WWG‘IU

If you add the -r option, you can repeat the process as many times as you want:

$ passgen.py -w -l 10 -A -r 5

Output:

Iv+@*y|FG>a*N]O#r0y*9w>):/bwmW<zB#PpC]+iRDxz‘{KU_f

The -V option will give you more verbose output:

$ passgen.py -w -l 10 -A -r 5 -V

Output:

Character Pool: (94 Chars) !"#$%&’()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_‘abcdefghijklmnopqrstuvwxyz{|}~^}3!E[P;mBonM*:,Np}E~mE=.70Lp5i~#2=>‘R1?k"{_|vZ9f5

If you don’t want to include all characters in your pool, you can choose one or more other character sets.

This command will use only lowercase letters and numbers:

$ passgen.py -w -l 10 -L -D -r 5 -V

Output:

Character Pool: (36 Chars) 0123456789abcdefghijklmnopqrstuvwxyzh5swp7zhryamljuqd84zpnwyqu7gj737pox69f6n90mr1533rz

Or you can choose custom characters with the -c option.

Like this:

$ passgen.py -w -l 10 -r 5 -V -c abc123

Output:

Character Pool: (6 Chars) 123abc233132a311



a311bbb321ca211b2313c21ca2b1b3c13b112a1b

Note: The -c or --chars option can be used together with the other character set options too. So you can add oneor more entire character sets and any combination of characters from other sets at the same time.

Testing Random Passwords

You can automatically test your generated passwords by adding the -t option, like this:

$ passgen.py -w -l 10 -A -r 3 -V -t

Output:

Character Pool: (94 Chars) !"#$%&’()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_‘abcdefghijklmnopqrstuvwxyz{|}~

Password: !98QSBE"3sChars: 10Char Variety: 4/4Blind Entropy: 65.5 BitsPool Entropy: 65.5 BitsUnique Chars: !BEs3QS"98 (10/10)

Password: qv’<+Bw?SxChars: 10Char Variety: 3/4Blind Entropy: 65.5 BitsPool Entropy: 65.5 BitsUnique Chars: B’+qSwvx<? (10/10)

Password: @0C=0fq/gXChars: 10Char Variety: 4/4Blind Entropy: 65.5 BitsPool Entropy: 65.5 BitsUnique Chars: @Cgf/q0X= (9/10)

Note: See Output Values for information on what this output means.

Note: You can also use passtest.py to test an already existing password.

1.2. passgen.py 13


Pattern-Generated Passwords

Generating Pattern-Based Passwords

If you need to make a password that follows a certain pattern, you can use the --pattern option, followed by thepattern that you want.

Pattern: ne:ne:ne:...ne, where n is an integer, and e is an element.

Elements:

• a: Insert a character chosen from all printable ASCII characters.

• u: Insert a character chosen from all upper case characters.

• l: Insert a character chosen from all lower case characters.

• d: Insert a character chosen from all digit characters.

• p: Insert a character chosen from all punctuation characters.

If you wanted a password starting with 3 randomly selected punctuation chars, followed by 2 digit chars, 2 upper casechars, and 2 lower case chars, you could use the following command:

$ passgen.py -w -r 5 --pattern 3p:2d:2u:2l

Output:

<:{40RVbo(]|80RWxl>?.14KQbk,*[39OIys

*‘-30JWiz

Note: Length and character set options are not required when making a pattern-generated password, since they arealready set by the pattern that you choose.

Testing Pattern-Based Passwords

As with testing purely random passwords, you can also test a pattern-generated password by adding the -t option.

Here’s an example:

$ passgen.py -w -r 3 --pattern 2u:3d:2p:2l -t

Output:

Password: OD293@*cyChars: 9Char Variety: 4/4Blind Entropy: 59.0 BitsPattern Entropy: 38.8 BitsUnique Chars: @cD*Oy329 (9/9)

Password: EO531:_qdChars: 9Char Variety: 4/4Blind Entropy: 59.0 Bits



Pattern Entropy: 38.8 BitsUnique Chars: qEdO135:_ (9/9)

Password: NA638+:ggChars: 9Char Variety: 4/4Blind Entropy: 59.0 BitsPattern Entropy: 38.8 BitsUnique Chars: Ag+N368: (8/9)


Note: You can also use passtest.py to test an already existing password.

Passphrases

Generating Passphrases

Passphrases can be generated using randomly selected words from a chosen wordlist by using the -p option.

The wordlist must be supplied via the –wordlist option, and must be a text file, with one word per line.

When generating a passphrase, the -l option sets the number of words in the phrase, instead of the number of characters.

Example:

$ passgen.py -p -l 4 -r 3 --wordlist wordlist.txt

Output:

wearyBelaitesWoodyropesUcknewemptiersscoutsinterfereskindledrustedsquinted

You can choose to add characters to the word pool by using the character options, just like when creating a randompassword, but in in this case, each character will be added as a word in the list.

Example:

$ passgen.py -p -l 4 -r 3 -A --wordlist wordlist.txt

Output:

@mathPaphossuretishipintimationsVERBALAter3shinch-hightiledsynagogue

You can choose to select only from words that meet certain length requirements by using the –minlen and/or –maxlenoptions. The following example would only select words with a length greater than or equal to 3, and less than orequal to 4.

Example:

$ passgen.py -p -l 4 -r 3 -A --wordlist wordlist.txt --minlen 3 --maxlen 4

1.2. passgen.py 15


Output:

teamway!CrewSpeowaiflaw-the’hiedRuthsoilBearLive

Testing Passphrases

Passphrases can be tested just like other passwords, by using the --test option.

Example:

$ passgen.py -p -l 4 -r 3 -A --wordlist wordlist.txt -V --test

Output:

Word Pool: 49022 WordsCharacter Pool: (94 Chars) fawnpoityedCsmlrugh-cvbLASTD’kWEPORNGFIUBH47Kx!Yj"JMVz2109qZ\X6$5)3/Q>.8(%|_^@*~‘{+;[&=]}?#:,<

Phrase: webbedconsultethironsneutralizedWords: 4Chars: 32Char Variety: 1/4Blind Entropy: 209.7 BitsWord Entropy: 62.3 BitsUnique Words: [’irons’, ’webbed’, ’neutralized’, ’consulteth’] (4/4)Unique Chars: acbedihlonsrutwz (16/32)

Phrase: mast’stinkerShephuphanOswaldWords: 4Chars: 28Char Variety: 3/4Blind Entropy: 183.5 BitsWord Entropy: 62.3 BitsUnique Words: [’Shephuphan’, ’Oswald’, "mast’s", ’tinker’] (4/4)Unique Chars: aed’ihkmSOnpsrutwl (18/28)

Phrase: MakingForty-barrel-bull--poorEarthquakelargerWords: 4Chars: 45Char Variety: 3/4Blind Entropy: 295.0 BitsWord Entropy: 62.3 BitsUnique Words: [’Forty-barrel-bull--poor’, ’Making’, ’larger’, ’Earthquake’] (4/4)Unique Chars: abegFi-kMlonqpruthyE (20/45)


Note: You can also use passtest.py to test an already existing passphrase.



Testing For “Bad” Passwords

You can also test a password or passphrase to see if it’s in a list of known bad passwords by using the --test-badoption, and supplying a path to the list.

In addition to the normal output, this will give you a list of similar words (>= 85% similar) in the bad password list,and show you the degree of similarity.

Example:

$ passgen.py -p -l 1 -r 3 --wordlist wordlist.txt --test-bad bad_pwds.txt

Output:

Phrase: cleverlyWords: 1Chars: 8Char Variety: 1/4Blind Entropy: 52.4 BitsWord Entropy: 15.6 BitsUnique Words: [’cleverly’] (1/1)Unique Chars: celrvy (6/8)Similar Words In Bad Password List: 1DO NOT USE!!!clever - 85.71% match

Password: qwertyChars: 6Char Variety: 1/4Blind Entropy: 39.3 BitsUnique Chars: eqrtwy (6/6)Similar Words In Bad Password List: 18DO NOT USE!!!3qwerty - 92.31% match1qwertyu - 85.71% matchwerty - 90.91% matchqwerty6 - 92.31% matchqwerty2 - 92.31% matchqwert - 90.91% matchqwerty0 - 92.31% matchqwerty7 - 92.31% matchqwerty - 100.0% matchqwerty5 - 92.31% matchqwerty12 - 85.71% matchqwertyui - 85.71% match1qwerty - 92.31% matchqwertyqw - 85.71% matchqwerty06 - 85.71% matchqwerty4 - 92.31% matchqwerty00 - 85.71% matchqwerty1 - 92.31% match

Phrase: PirithousWords: 1Chars: 9Char Variety: 2/4Blind Entropy: 59.0 Bits

1.2. passgen.py 17


Word Entropy: 15.6 BitsUnique Words: [’Pirithous’] (1/1)Unique Chars: ihoPsrut (8/9)Similar Words In Bad Password List: 0


1.3 passtest.py

Test the strength of a password or passphrase.

Table of Contents

• passtest.py– Command Line Options– Output Values– Usage Examples

* Testing Passwords* Testing Pattern-Generated Passwords* Testing Passphrases* Testing For “Bad” Passwords


usage: passtest.py [-h] [-v] [-W TEXT] [-P [TEXT [TEXT ...]]][--pattern PATTERN] [--test-bad PATH] [--sourcelist PATH]

Test the strength of a password or passphrase.



-v, --version-W TEXT, --password TEXT

Test a password. (default: None)-P [TEXT [TEXT ...]], --passphrase [TEXT [TEXT ...]]

Test a passphrase. Input words separated by a space.ex. if passphrase = "theeaglehaslanded", input -P theeagle has landed (default: None)

--pattern PATTERN Test a pattern-generated password. (default: None)

Test Options:Choose options for password/passphrase testing.

--test-bad PATH Test password against a list of bad passwords.(default: None)

Passphrase Options:



Choose options for passphrase testing.

--sourcelist PATH The wordlist that was used to generate the passphrasethat is being tested (default: None)

1.3.2 Output Values

When testing a password, the output will look something like this:

Password: abc123Chars: 6Char Variety: 2/4Blind Entropy: 39.3 BitsUnique Chars: acb132 (6/6)

The following table is a breakdown of what these values mean.

Title DescriptionPass-word

The password that was tested.

Chars The number of characters in the password.CharVariety

A rating based on the characters that the password contains from each character set (upper, lower,digits, punctuation). A rating of 3/4 means that the password contains at least one character fromthree of the four sets.

BlindEntropy

A measure of the theoretical entropy of the password when the character pool used to generate thepassword is unknown to a potential attacker. It assumes that the password was generated from a poolcontaining all 94 printable ASCII characters. This can be used as an indicator of the difficulty ofcracking the password when the character pool is unknown.

PoolEntropy

Similar to Blind Entropy, but accounts for the size of the character pool used to generate the password.This assumes that an attacker knows which character set was used to generate the password, and canbe used as an indicator of the difficulty of cracking the password when the character pool is known.

PatternEntropy

Like Pool Entropy, except it also accounts for the pattern used to generate the password. This can beused as an indicator of how difficult it would be for an attacker to crack the password when the patternused to generate it is known. This will usually be significantly lower than a purely random password.

WordEntropy

Like Pool Entropy, except it uses a word pool instead of character pool to calculate the entropy of apassphrase.

UniqueChars

The unique characters in the password.


Testing Passwords

Testing a password is very easy. Just use the --password option, followed by the password to be tested

Command:

$ passtest.py --password abc123

Output:

Password: abc123Chars: 6Char Variety: 2/4

1.3. passtest.py 19


Blind Entropy: 39.3 BitsUnique Chars: acb132 (6/6)


Testing Pattern-Generated Passwords

To test a pattern-generated password, you need to supply the password using the --password option, and the patternused to generate that password, using the --pattern option.

In this case, the password was generated using the pattern 3l:3d (3 lowercase, 3 digits).

Command:

$ passtest.py --password abc123 --pattern 3l:3d

Output:

Password: abc123Chars: 6Char Variety: 2/4Blind Entropy: 39.3 BitsPattern Entropy: 24.1 BitsUnique Chars: acb132 (6/6)


Testing Passphrases

To test a passphrase, use the -P option, followed by the words used in the passphrase. You must also supply thewordlist which was used to generate the passphrase using the –sourcelist option. For example, if your passphrase wasthefatmanwalksalone, you would use the following command.

Example:

$ passtest.py -P the fat man walks alone --sourcelist wordlist.txt

Output:

Phrase: thefatmanwalksaloneWords: 5Chars: 19Char Variety: 1/4Blind Entropy: 124.5 BitsWord Entropy: 77.9 BitsUnique Words: [’alone’, ’the’, ’walks’, ’fat’, ’man’] (5/5)Unique Chars: aefhkmlonstw (12/19)




Testing For “Bad” Passwords

You can also test a password or passphrase to see if it’s in a list of known bad passwords by using the --test-badoption, and supplying a path to the list.

In addition to the normal output, this will give you a list of similar words (>= 85% similar) in the bad password list,and show you the degree of similarity.

Example:

$ passtest.py --password qwerty --test-bad bad_pwds.txt

Output:

Password: qwertyChars: 6Char Variety: 1/4Blind Entropy: 39.3 BitsUnique Chars: eqrtwy (6/6)Similar Words In Bad Password List: 18DO NOT USE!!!3qwerty - 92.31% match1qwertyu - 85.71% matchwerty - 90.91% matchqwerty6 - 92.31% matchqwerty2 - 92.31% matchqwert - 90.91% matchqwerty0 - 92.31% matchqwerty7 - 92.31% matchqwerty - 100.0% matchqwerty5 - 92.31% matchqwerty12 - 85.71% matchqwertyui - 85.71% match1qwerty - 92.31% matchqwertyqw - 85.71% matchqwerty06 - 85.71% matchqwerty4 - 92.31% matchqwerty00 - 85.71% matchqwerty1 - 92.31% match


1.3. passtest.py 21



CHAPTER

TWO

API

2.1 Modules

2.1.1 randstrs

randstrs.rstypes

randstrs.rstypes.CharacterPool

randstrs.rstypes.WebWordListrandstrs.rstypes.WordListrandstrs.rstypes.SuperList

randstrs.rstypes.Passphrase

randstrs.rstypes.Password

randstrs.rstypes.PatternPassword

randstrs.rstypes.Word

Author James Knoblauch

Version 0.3.0

Copyright Copyright 2010-2013 James Knoblauch

License GPL

Summary Generate and/or manipulate wordlists from a variety of sources.

Requires Python >= 2.6

class randstrs.rstypes.SuperList(l=None, path=None, file_object=None)Bases: object

Behaves like a list, but has extra methods. Methods that would normaly return a list will return a SuperListinstead. The methods from other types, such as str, have return behavior as they would for that type. Forexample, SuperList.upper() returns a new list, because str.upper() would return a new string. Itdoes not edit the list in place.

upper()Apply string.upper() to each item in a list to make them upper case.

23


Return

•(list) A list with all upper case items.

Usage

>>> list1 = SuperList(["Soft", "words", "are", "hard", "arguments",... ".", "-", "Thomas", "Fuller",])>>> list1.upper()[’SOFT’, ’WORDS’, ’ARE’, ’HARD’, ’ARGUMENTS’, ’.’, ’-’, ’THOMAS’,’FULLER’]

lower()Apply string.lower() to each item in a list to make them lower case.

Parameters

•l: (list) A list

Return

•(list) A list with all lower case items.

Usage

>>> list1 = SuperList(["To", "be", "is", "to", "do", ".", "-",... "Plato"])>>> list1.lower()[’to’, ’be’, ’is’, ’to’, ’do’, ’.’, ’-’, ’plato’]

cull(minlen=None, maxlen=None)

Removes all items greater than maxlen and/or less than minlen. minlen and maxlen are bothoptional.

Parameters

•minlen: (int) The minimum desired length of each item in the list.

•maxlen: (int) The maximum desired length of each item in the list.

Usage

>>> list1 = SuperList(["Procrastination", "is", "opportunity’s",... "assassin", ".", "-", "Victor", "Kiam"])>>> list1.cull(minlen=3, maxlen=4)>>> list1[’Kiam’]

>>> list1.cull(minlen=3)>>> list1[’Procrastination’, "opportunity’s", ’assassin’, ’Victor’, ’Kiam’]

24 Chapter 2. API


>>> list1.cull(maxlen=2)>>> list1[’is’, ’.’, ’-’]

chain(lists)Combine an arbitrary number of lists with this one.

Parameters

•*lists: (list) Any number of lists to be combined.

Return

•(list) A combined list.

Usage

>>> list1 = SuperList([’a’, ’b’, ’c’])>>> list2 = [1, 2, 3]>>> list3 = [’z’, ’y’, ’x’]>>> list1.chain(list2, list3)[’a’, ’b’, ’c’, 1, 2, 3, ’z’, ’y’, ’x’]

strip(chars=None)Apply string.strip(chars) to each item in a list to strip the chosen characters from each item.

Parameters

•chars: (str) The characters to be stripped.

Return

•(list) A list with leading and trailing chars stripped from each item.

Usage

>>> list1 = SuperList([’foo’, ’foooo’, ’fo’, ’bar’, ’baarr’])>>> list1.strip(chars=’fr’)[’oo’, ’oooo’, ’o’, ’ba’, ’baar’]

unique()Return unique items from a list or string. If seq is a string, and keepstr is True, a string will be returned. Ifnot keepstr, a list will be returned. If seq is not a string, the return type will be the same as the input type.

Parameters

•seq: (iter) An interable sequence.

•keepstr: (bool) Return output from string in string form.

Return

•(iter) A sequence containing only unique items.

Usage

2.1. Modules 25


>>> list1 = [’a’, ’b’, ’a’, 6, 6]>>> unique(list1)[’a’, ’b’, 6]

unique_chars()Get the unique characters from all strings in a list.

Return

•(list) A list containing the unique chars.

Usage

>>> list1 = [’FOO’, ’foo’, ’Foooo’, ’fo’, ’baR’, ’baR’, ’baarr’]>>> unique_chars_in_list(l=list1)[’a’, b’, ’B’, ’f’, ’F’, ’o’, ’O’, ’r’, ’R’ ]

clean(case=’lower’)Make each item in a list either upper or lower case, then remove duplicates.

Parameters

•case: (str) Choose “upper” or “lower”.

Return

•(list) A list with all lower case items and no duplicates.

Usage

>>> list1 = SuperList([’FOO’, ’foo’, ’Foooo’, ’fo’, ’baR’, ’baR’,... ’baarr’])>>> list1.clean(case=’lower’)[’foo’, ’foooo’, ’fo’, ’bar’, ’baarr’]

translate(table=None, delchars=None)Perform string.translate() on each item in a list. Delete all characters from string that are in deletechars(if present), and then translate the characters using table, which must be a 256-character string givingthe translation for each character value, indexed by its ordinal. If table is None, then only the characterdeletion step is performed.

Parameters

•table: (str) Translation table.

•delchars: (str) Characters to be deleted.

Return

•(list) A list containing the translated items.

Usage

26 Chapter 2. API


>>> list1 = [’foo’, ’foooo’, ’fo’, ’bar’, ’baarr’]>>> translate_list(l=list1, table=None, delchars=’or’)[’f’, ’f’, ’f’, ’ba’, ’baa’]

>>> list1 = [’foo’, ’foooo’, ’fo’, ’bar’, ’baarr’]>>> t = string.maketrans(’o’, ’s’)>>> translate_list(l=list1, table=t)[’fss’, ’fssss’, ’fs’, ’bar’, ’baarr’]

floatify()Apply float() to each item in a list.

Return

•(list) A list of floats.

Usage

>>> list1 = [1, 2, 3, ’4’, ’5’, ’6’]>>> float_list(l=list1)[1.0, 2.0, 3.0, 4.0, 5.0, 6.0]

intify()Apply int() to each item in a list.

Parameters

•l: (list) A list.

Return

•(list) A list of integers.

Usage

>>> list1 = [1, 2, 3, ’4’, ’5’, ’6’]>>> int_list(l=list1)[1, 2, 3, 4, 5, 6]

strify()Apply str() to each item in a list.

Parameters


Return

•(list) A list of strings.

Usage

2.1. Modules 27


>>> list1 = [’a’, ’b’, ’c’, 1, 2, 3]>>> str_list(l=list1)[’a’, ’b’, ’c’, ’1’, ’2’, ’3’]

to_file(path=None, file_object=None)Write a list to a text file, adding a newline after each item.

Parameters

•path: (str) Path of file to write.

Return

•(None) Nothing

Usage

>>> list1 = [’foo’, ’foooo’, ’fo’, ’bar’, ’baarr’]>>> write_to_file(list1, ’res/wl/wordlist.txt’)

from_file(path=None, file_object=None, append=False)Read a list from a properly formatted text file, with one item per line.

Parameters

•path: (str) Path to text file.

Return

•(list) A list containing each item in the text file.

Usage

>>> read_from_file(’res/wl/wordlist.txt’)[’word1’, ’word2’, ’word3’, ..., ’wordn’]

class randstrs.rstypes.WebWordList(urls)Bases: randstrs.rstypes.WordList

Create wordlists from the web.

from_site(url)Create a list of words found in the visible text of a webpage.

Parameters

•url: (str) The URL of a webpage.

Return

•(list) A list containing all visible words from the page at url.

from_sites()Create a list of words found in the visible text of multiple webpages.

Parameters

28 Chapter 2. API


•urls: (list) A list containing URLs.

Return

•(list) A list containing all visible words from the pages at urls.

from_random_site()Create a list of words found in the visible text of a webpage chosen randomly from a list of URLs.

Parameters

•urls: (list) A list containing URLs.

Return

•(list) A list containing all visible words from a random webpage in urls.

randstrs.passtest

randstrs.passtest.PassTest


Version 0.3.0


License GPL

Summary Test the strength of a password.


randstrs.listtools

randstrs.listtools.ListGen


Version 0.3.0


2.1. Modules 29


License GPL

Summary Functions for performing a variety of actions on lists.


randstrs.listtools.chain(*lists)Combine an arbitrary number of lists into a single list.

Parameters

•*lists: (list) Any number of lists to be combined.

Return

•(list) A combined list.

Usage

>>> list1 = [’a’, ’b’, ’c’]>>> list2 = [1, 2, 3]>>> list3 = [’z’, ’y’, ’x’]>>> list1.chain(list1, list2, list3)[’a’, ’b’, ’c’, 1, 2, 3, ’z’, ’y’, ’x’]

randstrs.listtools.cull(l, minlen=None, maxlen=None)Create a new list containing only the items from the original with the chosen length values. minlen and maxlenare both optional.

Parameters

•l: (list) The original list

•minlen: (int) The minimum desired length of each item in the list.

•maxlen: (int) The maximum desired length of each item in the list.

Return

•(list) A list containing only the items where minlen <= len(item) <= maxlen.

Usage

>>> list1 = ["Procrastination", "is", "opportunity’s", "assassin",... ".", "-", "Victor", "Kiam"]>>> keep_length(l=list1, minlen=3, maxlen=4)[’Kiam’]

>>> keep_length(l=list1, minlen=3)[’Procrastination’, "opportunity’s", ’assassin’, ’Victor’, ’Kiam’]

>>> keep_length(l=list1, maxlen=2)[’is’, ’.’, ’-’]

randstrs.listtools.shuffle(l)Shuffle a list twice using random.SystemRandom().

Parameters

30 Chapter 2. API


•l: (list) A list

Return

•(list) A shuffled list

Usage

>>> list1 = ["Brevity", "is", "the", "soul", "of", "wit", ".",... "-", "William", "Shakespeare"]>>> shuffle_list(l=list1)[’soul’, ’Brevity’, ’.’, ’-’, ’wit’, ’the’, ’William’, ’is’,’of’, ’Shakespeare’]

randstrs.listtools.lower(l)Apply string.lower() to each item in a list to make them lower case.

Parameters

•l: (list) A list

Return

•(list) A list with all lower case items.

Usage

>>> list1 = ["To", "be", "is", "to", "do", ".", "-", "Plato"]>>> lower_list(l=list1)[’to’, ’be’, ’is’, ’to’, ’do’, ’.’, ’-’, ’plato’]

randstrs.listtools.upper(l)Apply string.upper() to each item in a list to make them upper case.

Parameters

•l: (list) A list

Return

•(list) A list with all upper case items.

Usage

>>> list1 = ["Soft", "words", "are", "hard", "arguments", ".",... "-", "Thomas", "Fuller",]>>> upper_list(l=list1)[’SOFT’, ’WORDS’, ’ARE’, ’HARD’, ’ARGUMENTS’, ’.’, ’-’, ’THOMAS’,’FULLER’]

randstrs.listtools.strip(l, chars=None)Apply string.strip(chars) to each item in a list to strip the chosen characters from each item.

Parameters

•l: (list) A list

2.1. Modules 31


•chars: (str) The characters to be stripped.

Return

•(list) A list with leading and trailing chars stripped from each item.

Usage

>>> list1 = [’foo’, ’foooo’, ’fo’, ’bar’, ’baarr’]>>> strip_list(l=list1, chars=’fr’)[’oo’, ’oooo’, ’o’, ’ba’, ’baar’]

randstrs.listtools.clean(l, case=’lower’)Make each item in a list either upper or lower case, then remove duplicates.

Parameters

•l: (list) A list

•case: (str) Choose “upper” or “lower”.

Return

•(list) A list with all lower case items and no duplicates.

Usage

>>> list1 = [’FOO’, ’foo’, ’Foooo’, ’fo’, ’baR’, ’baR’, ’baarr’]>>> clean_list(l=list1)[’foo’, ’foooo’, ’fo’, ’bar’, ’baarr’]

randstrs.listtools.translate(l, table=None, delchars=None)Perform string.translate() on each item in a list. Delete all characters from string that are in deletechars (ifpresent), and then translate the characters using table, which must be a 256-character string giving the transla-tion for each character value, indexed by its ordinal. If table is None, then only the character deletion step isperformed.

Parameters

•l: (list) A list containing items to be translated.

•table: (str) Translation table.

•delchars: (str) Characters to be deleted.

Return

•(list) A list containing the translated items.

Usage

>>> list1 = [’foo’, ’foooo’, ’fo’, ’bar’, ’baarr’]>>> translate_list(l=list1, table=None, delchars=’or’)[’f’, ’f’, ’f’, ’ba’, ’baa’]

32 Chapter 2. API


>>> list1 = [’foo’, ’foooo’, ’fo’, ’bar’, ’baarr’]>>> t = string.maketrans(’o’, ’s’)>>> translate_list(l=list1, table=t)[’fss’, ’fssss’, ’fs’, ’bar’, ’baarr’]

randstrs.listtools.unique(seq, keepstr=True)Return unique items from a list or string. If seq is a string, and keepstr is True, a string will be returned. If notkeepstr, a list will be returned. If seq is not a string, the return type will be the same as the input type.

Parameters

•seq: (iter) An interable sequence.

•keepstr: (bool) Return output from string in string form.

Return

•(iter) A sequence containing only unique items.

Usage

>>> list1 = [’a’, ’b’, ’a’, 6, 6]>>> unique(list1)[’a’, ’b’, 6]

>>> str1 = ’abcdabcd’>>> unique(str1)’abcd’

>>> str1 = ’abcdabcd’>>> unique(seq=str1, keepstr=False)[’a’, ’b’, ’c’, ’d’]

randstrs.listtools.unique_chars(l)Get the unique characters from all strings in a list.

Parameters

•l: (list) A list

Return

•(list) A list containing the unique chars.

Usage

>>> list1 = [’FOO’, ’foo’, ’Foooo’, ’fo’, ’baR’, ’baR’, ’baarr’]>>> unique_chars_in_list(l=list1)[’a’, b’, ’B’, ’f’, ’F’, ’o’, ’O’, ’r’, ’R’ ]

randstrs.listtools.floatify(l)Apply float() to each item in a list.

Parameters


2.1. Modules 33


Return

•(list) A list of floats.

Usage

>>> list1 = [1, 2, 3, ’4’, ’5’, ’6’]>>> float_list(l=list1)[1.0, 2.0, 3.0, 4.0, 5.0, 6.0]

randstrs.listtools.intify(l)Apply int() to each item in a list.

Parameters


Return

•(list) A list of integers.

Usage

>>> list1 = [1, 2, 3, ’4’, ’5’, ’6’]>>> int_list(l=list1)[1, 2, 3, 4, 5, 6]

randstrs.listtools.strify(l)Apply str() to each item in a list.

Parameters


Return

•(list) A list of strings.

Usage

>>> list1 = [’a’, ’b’, ’c’, 1, 2, 3]>>> str_list(l=list1)[’a’, ’b’, ’c’, ’1’, ’2’, ’3’]

randstrs.listtools.pad(l, lpad=’‘, rpad=’‘)Pad each word in a list with the chosen characters.

Parameters

•l: (list) The list to be processed.

•lpad: (str) Left pad the words with the chosen characters.

•rpad: (str) Right pad the words with the chosen characters.

Return

34 Chapter 2. API


•(list) The list of padded words.

randstrs.wordtools


Since 2010-12-12


License GPL

Summary Generate passwords and passphrases.


randstrs.wordtools.pad(word, lpad=’‘, rpad=’‘)Pad a word with the chosen characters.

Parameters

•word: (str) The word to be processed.

•lpad: (str) Left pad the word with the chosen characters.

•rpad: (str) Right pad the word with the chosen characters.

Return

•(str) The padded word.

randstrs.wordtools.num_len(n)Get the length in digits of a number.

Parameters

•n: (int) The number to be measured.

Return

•(int) The number of digits

randstrs.optiontools

randstrs.optiontools.Options


Version 0.3.0


2.1. Modules 35


License GPL

Summary Functions for use with command line options.


class randstrs.optiontools.OptionsBases: object

Tools for managing optional arguments from argparse.

option_used_from_group(group)Check if an option is used from a group of options.

Parameters

•group: (dict) Dictionary containing argparse options.

Return

•(bool) True if an option is used from the group, else False.

check_mutually_exclusive(group)Check if options are used from a group of mutually exclusive options and return True if the number ofused options is less <= 1, False if > 1. Store the used options for later use.

Parameters

•group: (dict) A dictionary containing a group of argparse options.

Return

•(bool) True if less than one option is used, else False.

randstrs.parsetools

randstrs.parsetools.GetWords

randstrs.parsetools.GetHTML


Version 0.3.0


License GPL

Summary Functions for retrieving data from the web.


36 Chapter 2. API


class randstrs.parsetools.GetHTMLBases: object

Class for collecting information from websites.

static html_text(url)Get the HTML text from a webpage.

Parameters


Return

•(list) A list containing HTML text.

static visible_text(url)Get the visible text from a webpage.

Parameters


Return

•(list) A list containing visible text.

2.1.2 scripts

listgen

scripts.listgen.Main


Version 0.3.0


License GPL

Summary Generate and/or manipulate wordlists from a variety of sources.


class scripts.listgen.MainBases: object

Run main program.

parse_args()Parse command line arguments.

2.1. Modules 37


passgen

scripts.passgen.Main


Version 0.3.0


License GPL

Summary Generate passwords and passphrases.


class scripts.passgen.MainBases: object

Run main program.


password()Generate a random password.

pattern_password()Generate a pattern-based random password.

passphrase()Generate a random passphrase.

passtest

scripts.passtest.Main


Version 0.3.0


License GPL

Summary Test the strength of a password.

38 Chapter 2. API



class scripts.passtest.MainBases: object

Run main program.


2.2 Indices and tables

• genindex

• modindex

• search

2.2. Indices and tables 39


40 Chapter 2. API

CHAPTER

THREE

RESOURCES

3.1 Information

NIST Special Publication 800-63 - Electronic Authentication Guideline: http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf

Password Strength: https://secure.wikimedia.org/wikipedia/en/wiki/Password_strength

Diceware: http://world.std.com/~reinhold/diceware.html

3.2 Tools

KeePass: http://keepass.info

KeePassX: http://www.keepassx.org

41

http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf

http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf

https://secure.wikimedia.org/wikipedia/en/wiki/Password_strength

http://world.std.com/~reinhold/diceware.html

http://keepass.info

http://www.keepassx.org


42 Chapter 3. Resources

CHAPTER

FOUR

INDICES AND TABLES

• genindex

• modindex

• search

43


44 Chapter 4. Indices and tables

PYTHON MODULE INDEX

rrandstrs.listtools, 29randstrs.optiontools, 35randstrs.parsetools, 36randstrs.passtest, 29randstrs.rstypes, 23randstrs.wordtools, 35

sscripts.listgen, 37scripts.passgen, 38scripts.passtest, 38

45

Documents

Release 0.3.0 James Knoblauch - Read the Docs · randstrs Documentation, Release 0.3.0 Wordlist Source Options: Choose options for wordlist sources.--import PATH Import a wordlist