No project description provided
Project description
ComPP - Company Passwords Profiler
Company Passwords Profiler (aka ComPP) helps making a bruteforce wordlist for a targeted company.
What ❓
The tool responds to a need to generate wordlists quickly with few inputs. The generated passwords will contain generic company informations with transformation such as APPNAME2019! or Company75000$.
The main use of the generated wordlist is with remote bruteforce and password spraying attack such as a ssh service or a WordPress website.
This tool aims to replace CeWL because web scrapping is not be the most efficient way to generate a wordlist.
Note: If you have time to perform OSINT research against the targeted users, you may use tools such as CUPP or BEWGor to complete your wordlist.
Install ⚙️
sudo python setup.py install
Inputs 🔡
User inputs can either be filled in the interactive prompt or through a json file. If an input is unknown to the user, it suffices to leave the field empty in order to go to the next field. Here is the full program prompt:
$ ComPP
Fill the differents inputs (case insensitive). Leave blank for unknow fields.
[+] Enter company/application names (comma separated): Company,Comp
[+] Enter company zip codes (comma separated): 75,75000
[+] Enter company cities names (comma separated): Paris
[+] Useful keywords (comma separated): Appname
or
$ ComPP company.json
Outputs
Output size may vary with the provided options. Here is a preview of what you can expect with the default options:
appname$
CompParis2000
Company75000!
COMPANYAPPNAME2019#
What are the proposed transformations ?
- First, the tool compute case transformation for each fields (lowercase, UPPERCASE and Capitalize). The originals set of fields and the 3 generated sets are added to the wordlist.
- Then, the tool apply itertools.combination() on each set with a default size up to 2. The use of such combination avoid having the same word twice in the same password. The generated combinations are added to the wordlist
- The tool add a range of years to the previously generated wordlist. The original wordlist is also kept.
- The tool add a range of special chars to the previously generated wordlist. The original wordlist is also kept.
- (Optional) The tool add a range of numbers to the previously generated wordlist. The original wordlist is also kept.
- (Optional) The tool add a l33t transformation to the previously generated wordlist. The original wordlist is also kept.
Author
Made by Alex G. (@zeecka_), pentester at SEC-IT.
