-2
\$\begingroup\$

I wrote a script that reads a file containing a password ("password"), loops each character in that file to see if it matches a character in the alphabet, and when every letter has been found the password is printed.

def readFile():
    file = raw_input("Enter file that contains the password: ");
    file = open(file, 'r');
    return file.read();

alphabet = 'abcdefghijklmnopqrstuvwxyz';

password = ''

Notfound = True;

while Notfound:
    for i in readFile():
      for j in alphabet:
        if i == j:
            password += j;
            Notfound = False;

print(password);

Could this be considered a VERY basic implementation of a brute force script?

\$\endgroup\$
  • \$\begingroup\$ I don't understand what you are asking. If I answered with "You are doing what should be a very simple task in an unnecessarily difficult and inefficient way, and probably not quite as intended", would you be satisfied? \$\endgroup\$ – 200_success Apr 8 '15 at 2:47
  • \$\begingroup\$ In other words, what do you want to accomplish, and why did you write the code this way? \$\endgroup\$ – 200_success Apr 8 '15 at 2:48
  • \$\begingroup\$ I am not trying to print the contents of a file. The goal is to create a script that can run through all the possibilities of what a password might be then print it to the user. What I am asking is if the way in which I am obtaining the password could be considered a brute force technique. Consider this, if I found a website which is vulnerable to sql injection, I could use a similar method to obtain a password in the database using get commands and running through all the possibilities of what the password could be by comparing each character to a predefined set of characters @200_success \$\endgroup\$ – l30n1d45 Apr 8 '15 at 2:51
  • \$\begingroup\$ So again; my question is if the method I am using could be considered as a brute force attack @200_success \$\endgroup\$ – l30n1d45 Apr 8 '15 at 2:57
4
\$\begingroup\$

I don't understand what you are trying to accomplish, or how it constitutes an attack. I'm also not certain that your code matches your stated goal. What do you mean by "every character has been found" — every character in what? You're just filtering file contents for characters that are lowercase letters, and stop after you find a file that contains such letters. Nearly every file on a computer will meet that requirement.

If you want to do that, you might as well write it better.

readFile() should be named prompt_and_read_file() to conform to Python naming conventions, and to indicate that it does more than one thing. File handles should be opened using a with block, so that they will be automatically closed. Semicolons at the end of statements are not idiomatic in Python.

Many tasks that require looping in other languages can often be done in Python using other techniques. Here, filtering out non-lowercase letters can be done using a regular expression.

import re

def prompt_and_read_file():
    with open(raw_input("Enter file that contains the password: ")) as f:
        return f.read()

while True:
    file_contents = prompt_and_read_file()
    password = ''.join(re.findall(r'[a-z]', file_contents))
    if password:
        break

print(password)
\$\endgroup\$
3
\$\begingroup\$

Could this be considered a basic brute-force? Sure, for a limited use-case, but even then it is pretty inefficient.

To be clear, normally a brute-force system requires checking all combinations against some hashing function to see if the hashed result matches the hashed password. For example, imagine the password is "password", and the hashed version of that is: 286755fad04869ca523320acce0dc6a4 (that's the actual MD5-hash of "password"). What you normally have for a brute-force system, is the hashed version, not the original version.

You would normally have to generate many possible passwords, and hash the results, and then see if the hashed results match the known hash, and from that, deduce that the passwords must have been guessed.

In your case, you are just checking each letter 1-at-a-time, against the raw password. That's not a very realistic situation. Still... you are brute-forcing things.

Let's work your algorithm to make it more efficient though.

What you are doing is reading files until you find one which has a password that is only letters a through z. How about code that does the negative of what you have:

def readFile():
    file = raw_input("Enter file that contains the password: ");
    file = open(file, 'r');
    return file.read();

alphabet = set('abcdefghijklmnopqrstuvwxyz');


while True:
    data = readFile()
    if len(set(data).difference(alphabet)) == 0:
        print(data)
        break

Note, we use the set-based handling in python. Convert the alphabet to a set, and then get the difference between the password set, and the alphabet. With that, if there are any characters left, then the password is not a match (there are characters in the password that are not in the alphabet).

Additionally, I found that your readFile method does not do decent end-of-line handling, so I had to create a file without a line-terminator to make the code work... is this intended?

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.