password crack dictionary

Question

I am very new to coding and I just jumped in and am trying some things.

I have been using the following code to create a password dictionary to crack wifi passwords with brute force but it will take a lifetime for it to run all possible combinations. How would I change the code so it doesn't start with 11111111 but instead shuffles combinations? Wouldn't that make the password finding faster? I am running windows 11 and python 3.11

import itertools as its
words = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890abcdefghijklmnopqrstuvwxyzº!§$%&/()=ß''+#-.,><@€|^~-{[]}ÄÖÜäöû'
r =its.product(words,repeat=8)
dic = open("pwd.txt","a")
for i in r:
    dic.write("".join(i))
    dic.write("".join("\n"))
dic.close()

Answer 1

Idea review

That's 100 different characters repeated 8 times, i.e. 100^8 or 10000000000000000 different passwords or 10000 Terabytes. I guess you can't really make that faster. Even with really fast modern NVME SSDs at 1500 MB/s, that'll take about 77 days to write on disk, if you can afford buying 10000 SSDs. Connecting them to your PC may take even longer. Given each SSD needs 8 Watts, you also need a small power plant in your garden.

[...] shuffles combinations wouldn't that make the password finding faster?

no. The average time to find the correct password is still the same. You just change the occurrence of luck.

I'm not really sure whether you want to perform a dictionary attack or a brute force attack. What you are doing is a brute force attack: you are generating all possible passwords (of length 8) and attempt to write them into a file. If you use that file as the dictionary for a dictionary attack, it's still a brute force attack. The idea of a dictionary attack is that you reduce the number of possibilities by using words of a real English dictionary, not a Python dictionary (hashmap).

Hacking WiFi in real world is typically fast due to vulnerabilities in the WiFi standard or implementations of it.

Code review

It's a great idea to use a finished library instead of writing functions to get the combinations yourself. That reduces mistakes, saves you lines of code and is well understood by everyone knowing the library.

Naming

words is not a good name. That string does not contain words, but characters.

I can't even think what you wanted to express with r. It's a list of combinations of 8 characters, which is a potential WiFi password each. So let's call that passwords or so.

dic is not a good name, because open() does not return a dictionary, but a file handle instead. Calling that file would be ok I think. Or dictionary_file if you want to go really descriptive.

i is commonly used in for loops, but not in foreach loops. If we replace r by passwords as suggested before, then for password in passwords: is a nice choice. Note the subtle difference between singular and plural.

File handling

Use with to open files and have them closed properly. Look at an example on Stack Overflow

Newline

"".join("\n") is just "\n".

Spacing

Sometimes you have spaces around =, sometimes you don't. There is PEP8 which defines rules for spacing.

Result

import itertools as its
characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890abcdefghijklmnopqrstuvwxyzº!§$%&/()=ß''+#-.,><@€|^~-{[]}ÄÖÜäöû'
passwords = its.product(characters, repeat=8)
with open("pwd.txt", "a") as file:
    for password in passwords:
        file.write("".join(password))
        file.write("\n")