Coolio12's Python question (was Confused with Python...)

[HowardE]

Re: Confused with Python and Need Help Debugging
Postby Coolio12 » Wed Dec 24, 2014 10:45 am

I also had two questions:
1) What is different about password6?
2) How much would I have to change to crack a user-entered password?
Thank you in advance for any help.
Coolio12

Posts: 1
Joined: Mon Dec 22, 2014 9:17 am
Occupation: Student - 9th
Project Question: Python Password Cracker
Project Due Date: n/a
Project Status: I am conducting my research

Madeline B had an excellent point, so I moved your question to a new topic.

I'll answer your questions like this. The point of the project is to come up with an algorithm that can guess what someone's password might be. How does it do that? There's the brute force way where you just try every possible password but the math points out how time consuming that would be. One of my accounts has a 24 character gibberish password - it would take multiple lifetimes for a fast computer to guess it that way. You can also guess passwords by using dictionaries and the project comes with a sample dictionary of passwords that people have been known to use. Try those and combine them in different ways and maybe you can guess the passwords that way. The project asks you to research methods that people use to create passwords and then design a program that figures out what people picked. So, armed with a few methods, the program provided can guess 5 of the 6 sample passwords provided. The 6th one can't be easily guessed by just running the program as-is. Why? Maybe it's a number but has more than 4 digits. Maybe it's a word or a combination of words, but not words in the sample dictionary. Maybe it's gibberish but uses characters not in the sample 62-char wheels. Who knows? If I tell you what's special about it, I'll be giving away the secret. I will tell you that it's not some outrageous string of gibberish like "JnL<U3zJbd#4K}se$&hE&E$$%+r[b<" or "fHSH<(!'Wh&Hr?T#`PpsE'FA49:$]e" which would be awesome passwords but would take millennia for a laptop computer to guess by brute force. If you can figure out ways that I might have come up with a password that's easy to remember but hard for you to guess, you can make some pretty simple modifications to one of the existing methods and then the program should find it pretty quickly.

So: 1) The method I used to generate it is different than the others. I can't say any more than that.

2) How much you have to change depends on how the user picked the password and unfortunately, you don't really know that. If they picked a 5 digit number, you simply have to tweak the suitcase lock method to try 5 digit numbers. If they picked the password "ScienceBuddies", you would just have to add "Science" and "Buddies" to your dictionary. What you're trying to do is understand (through your research) how people think about passwords and then tweak the program accordingly. If it were easy, passwords wouldn't be useful at all.

I hope that helps even though that's not really the answer you expected.

Howard

[Coolio12]

Howard,
First off, I greatly appreciate your response and I hope you had a very Merry Christmas.

I completely understand what you are saying about brute force because I had actually done the project which asked to create the Sudoku Solver. In this project it was important to use Brute force, but I cant seem to find a proper project in this python password cracker unless I have a user entered password. One of my ideas was to create a separate program in which the user could type his password and it would output it as a hashed string. They would then input this hashed string into the main program's input, which would then try to crack it. This way no extra information is being given and it is pretty much what you did but a few extra steps. But to do this I would have to change the main program so that it uses the crack methods on the user-entered string. That is where I get stuck because there is a lot to change and I get very lost. The best thing about writing your own program is knowing your logic and knowing what to change. Although I get the basis of your logic there are some things I am struggling with. By the time I think I know what I am doing, I get lost.

[HowardE]

Coolio, I did, thank you and I trust you did as well.

Perhaps I'm confused then, as the program as provided assumes you'd be entering a user password.

Code: Select all

def main(argv=None):
    global password0, password1, password2, password3
    global password4, password5, password6, totalguesses
    global which_password

    # This is a place for you to set a password of your own
    password0 = "314"
    # Set up the passwords we want to crack. These must be MD5 hash
    # data blocks. Set them up using MD5me like:
    #     'password1=MD5me("ScienceBuddies")'
    #
    password1="202cb962ac59075b964b07152d234b70"
    password2="570a90bfbf8c7eab5dc5d4e26832d5b1"
    password3="f78f2477e949bee2d12a2c540fb6084f"
    password4="09408af74a7178e95b8ddd4e92ea4b0e"
    password5="2034f6e32958647fdff75d265b455ebf"
    password6="9b3af42d61cde121f40b96097fb77d3e"

    # start searching
    which_password = 1
    which_password = int(input("Which password (0-6)? "))

After the helper functions are set up, the code finds its way into main() which presets the 6 passwords - 5 of them as MD5 hashes - and then asks the investigator to select which of the 6 it should attack. Password 0 is in plain text. In the example it's simply set to the 3-digit number "314" but this is where you could store in anything you like. So in my earlier message I suggested you might use "ScienceBuddies" as the password. You'd change the code to say

Code: Select all

 # This is a place for you to set a password of your own
    password0 = "314"

and then answer with '0' as the password number. The comparison routine doesn't go through the MD5 hash conversion for this one. You could modify the program so that it asks for a password string, stores that as password0, then sets which_password to 0 and continues.

Code: Select all

    # start searching
    which_password = 0
    password0 = input("What should I try to guess? ")
    print ("trying to guess "+password0)

That's a very minor modification. I certainly didn't expect everyone trying this project to tackle serious code writing but I think you'll find it fun to give it a try. Getting stuck is no fun so please feel free to shout out if that happens. One thing I think might help is to make any changes one at a time. If you change a whole bunch of code at once and it doesn't work, it can be a little frustrating to figure out what happened. So change something, test it, change a lithe bit more, test that, etc. I'll be happy to help out if you get yourself lost again.

Howard

Howard

[Coolio12]

I borrowed your hasher (With proper credit of course) and this is how it looks

Code: Select all

import sys, hashlib

def MD5me(s):
    result = s.encode("utf-8")
    result = hashlib.md5(result).hexdigest()
    return result
passhash = ""
passhash = input("Please enter your password")

prnt = MD5me(passhash)

print(prnt)

However I am having trouble copying the hash it outputs because command prompt does not allow it. I looked at other forums and they said to use modules such as TKinter and Pyperclip, but the setup does not seem to work for me. Do you know any workaround for this?

[Coolio12]

I also finished the modification to the other program so that it works fine, just need to clean it up a bit.

[Coolio12]

Nevermind I got it...

[Coolio12]

I ran into a problem when using another list of words, I am assuming that the error code "IndexError: string index out of range" means that it cannot check the list because it its too large. Do you know what the maximum is? This list had 109583 words

[Coolio12]

Nevermind got that too

[HowardE]

I'm away from a computer and I see you're figuring stuff out. We ought to be calling this part of the website "Ask Coolio".

I was going to point out that you need not hash the passwords to test them. Password 0 tests unhashed for convenience.

[Coolio12]

I am just a beginner trying to work my way through it. I really do appreciate all the guidance you have given me and your marvelous program, of course.

I thought about that but if the user entered their password and I outputted the same thing, it wouldn't look like it worked. However, if they entered a password that was one-way hashed in another program, it would be more believable to them even though it did the same process.

BTW I am still not able to get password 6.

[HowardE]

"Life is a journey, not a destination." - Ralph Waldo Emerson

You're right,of course. It looks wimpy if a program simply spits back your input and says it 'guessed' it. It's HOW it guesses it that matters though. From your questions it sounds like you're enjoying digging into the algorithms and coming up with your own. If you do manage to find password 6 in your journey, please follow the suggestion and proof it on the Science Buddies website. No spoilers though, except to reiterate that a fairly simple tweak on the existing code will find it pretty easily.


How did you work around the limit on the word list size? You obviously hit the limit of what an integer index can be and perhaps others will benefit from your solution. I'd be happy to include your fix in an updated version of the project at some point - with proper credit , of course.

Howard

[Coolio12]

I think I may have to try quite a number of simple changes before I can solve the sixth password. I think the hardest part is that there are so many places to start... But then again, I may be over thinking it.

To answer your question though, I ran a counter that increased every time another word was counted. I had hoped that this would lead me to the maximum that Python could check by showing the line at which it stopped, but it actually led me to a even simpler fix. There seemed to be a blank line in the text file that I was using. This null value was not able to be counted because there was nothing there! So, after deleting the line it works again. The list was a compilation of almost 97% of the words in the English language.

I have dabbled in many languages prior to this, but python is unique. It gives me a constant error saying "TabError: Inconsistent use of Tabs and Spaces." When this occurs I get very frustrated. It seems to show this error where it absolutely should not. If you have any light you could shed on this, such as a link, it be greatly appreciated.

[HowardE]

I thought the maximum value would have been 2^64-1 or WELL beyond 100,000 so I was puzzled why you had an issue. The blank line makes some sense though. A more robust implementation would screen for that situation and continue procesing without throwing an error. That's part of designing a program - making it adapt nicely to unexpected situations. I made no attempt here to do any of that.

The requirement of proper tabs and spaces is one of the joys of Python. I can't say I'm a huge fan either, but it's an easy language otherwise. Since it also runs on just about computer our user base will have access to, it's a good choice for Science Buddies programming projects. That said, if you wanted to take the idea and write your own code in C, C++, BASIC or something else, that would be awesome too.

To help keep your code error free, I'd suggest you ise the IDLE editor that comes with most Python installations. It's designed specifically for Pthon and is really good at helping you manage the spacing requirements. It's often called IDLE3 in Python 3 installations.

And yes, the password 6 challenge was meant to be a bit of a reach. You'll have an "ah ha" moment when you find it though.

Howard

[Coolio12]

The problem with writing in another language is that I already submitted my forms and I cannot go back on those. However, I would love to try it over summer after science fair.

I also cannot seem to find the idle3 tools, I have a folder which I downloaded.

The folder contains:
COPYING
idle3ctl.8
idle3ctl.c
Makefile
sgio.c
sgio.h


I know something is not right in these... But I may be wrong.

[HowardE]

I don't know how you installed Python but I've had good luck installing with the installers available at www.python.org/downloads. Getting the game and serial extensions loaded can be tricky, but these installers, specifically for OSX and Windows do a thorough job of installing things properly and giving you access to IDLE. The files in that folder you got may be source for IDLE but you can download and install binaries.

Howard