PACK (Password Analysis and Cracking Kit) was originally developed to aid me in a password cracking competition Crack Me If You Can during Defcon 2010.

During a few practice runs using bruteforce password cracking utilities (e.g. ighashgpu), I was surprised by how predictable were user selected passwords on social network sites. Further analysis into several leaked password dumps, like RockYou, has yielded many common password selection patterns (e.g. string of letters followed by one or two digits). There was a need for a tool to automate the analysis of such password dumps to come up with input rules for rule based password crackers such as oclHashcat. PACK meets this goal by generating a fine tuned list of password masks that can be used as an input for password cracking tools. The Password Analysis and Cracking Kit is also capable of generating several statistical reports based on password lengths, character-sets, patterns and passwords masks of passwords in a provided list.

While the aforementioned attack works great for a typical website, simple mask analysis is not sufficient for corporate password policies with a minimum password complexity. To speed up attacks against such targets, PACK includes a separate utility that can generate a set of input masks that include only passwords that comply with provided password complexity (e.g. one special, one digit, one upper characters). Depending on how restrictive is your target's password policy, you can often reduce the total cracking runtime in half by using this utility. Alternatively you can invert mask generation rules and specifically target non-compliant passwords.

The tool and complete documentation are available in the Projects section.