Brute force script for printing a password

Question

I wrote a script that reads a file containing a password ("password"), loops each character in that file to see if it matches a character in the alphabet, and when every letter has been found the password is printed.

def readFile():
    file = raw_input("Enter file that contains the password: ");
    file = open(file, 'r');
    return file.read();

alphabet = 'abcdefghijklmnopqrstuvwxyz';

password = ''

Notfound = True;

while Notfound:
    for i in readFile():
      for j in alphabet:
        if i == j:
            password += j;
            Notfound = False;

print(password);

Could this be considered a VERY basic implementation of a brute force script?

Answer 1

I don't understand what you are trying to accomplish, or how it constitutes an attack. I'm also not certain that your code matches your stated goal. What do you mean by "every character has been found" — every character in what? You're just filtering file contents for characters that are lowercase letters, and stop after you find a file that contains such letters. Nearly every file on a computer will meet that requirement.

If you want to do that, you might as well write it better.

readFile() should be named prompt_and_read_file() to conform to Python naming conventions, and to indicate that it does more than one thing. File handles should be opened using a with block, so that they will be automatically closed. Semicolons at the end of statements are not idiomatic in Python.

Many tasks that require looping in other languages can often be done in Python using other techniques. Here, filtering out non-lowercase letters can be done using a regular expression.

import re

def prompt_and_read_file():
    with open(raw_input("Enter file that contains the password: ")) as f:
        return f.read()

while True:
    file_contents = prompt_and_read_file()
    password = ''.join(re.findall(r'[a-z]', file_contents))
    if password:
        break

print(password)

Answer 2

Could this be considered a basic brute-force? Sure, for a limited use-case, but even then it is pretty inefficient.

To be clear, normally a brute-force system requires checking all combinations against some hashing function to see if the hashed result matches the hashed password. For example, imagine the password is "password", and the hashed version of that is: 286755fad04869ca523320acce0dc6a4 (that's the actual MD5-hash of "password"). What you normally have for a brute-force system, is the hashed version, not the original version.

You would normally have to generate many possible passwords, and hash the results, and then see if the hashed results match the known hash, and from that, deduce that the passwords must have been guessed.

In your case, you are just checking each letter 1-at-a-time, against the raw password. That's not a very realistic situation. Still... you are brute-forcing things.

Let's work your algorithm to make it more efficient though.

What you are doing is reading files until you find one which has a password that is only letters a through z. How about code that does the negative of what you have:

def readFile():
    file = raw_input("Enter file that contains the password: ");
    file = open(file, 'r');
    return file.read();

alphabet = set('abcdefghijklmnopqrstuvwxyz');


while True:
    data = readFile()
    if len(set(data).difference(alphabet)) == 0:
        print(data)
        break

Note, we use the set-based handling in python. Convert the alphabet to a set, and then get the difference between the password set, and the alphabet. With that, if there are any characters left, then the password is not a match (there are characters in the password that are not in the alphabet).

Additionally, I found that your readFile method does not do decent end-of-line handling, so I had to create a file without a line-terminator to make the code work... is this intended?