pack

PACK was developed for the 'Crack Me If You Can' password cracking competition at Defcon 2010. The toolkit analyzes common password creation methods from wordlists, generating statistical databases used to create targeted attack masks for tools like oclHashcat. It does not crack passwords itself but enhances other tools' efficiency.

Key components include statsgen for password statistics by length, charset, complexity, and masks; policygen for generating masks based on password policies; maskgen for filtering and sorting masks; rulegen for rule generation from passwords; and others like dictstat (deprecated). Use cases include preparing for password cracking contests, optimizing Hashcat attacks, and testing password policy compliance.

The tool processes large wordlists like rockyou.txt to reveal patterns such as prevalent character sets (e.g., loweralphanum, numeric) and simple masks (e.g., stringdigit), enabling focused attacks that cover high-probability patterns faster than brute force.

PACK analyzes wordlists to categorize passwords by length, character sets (loweralpha, numeric, etc.), complexity (min/max counts of digit/lower/upper/special), simple masks (e.g., stringdigit), and advanced masks (e.g., ?l?l?l?l?l?l?d?d). Statsgen filters by min/max length or charset, producing relative statistics. Policygen generates all compliant Hashcat masks for defined policies (e.g., length=8, minupper=1, mindigit=1). Maskgen sorts/filter by runtime, complexity, occurrence using passwords-per-second rates. Rulegen derives transformation rules from passwords using edit distance and spell-checking.