OWASP / passfault

OWASP Passfault evaluates passwords and enforces password policy in a completely different way.
https://passfault-hrd.appspot.com
Apache License 2.0
170 stars 90 forks source link

'gradle build' doesn't include worldlists in jar #43

Open apbryan opened 9 years ago

apbryan commented 9 years ago

cloning this repository and running gradle build followed by java -jar core/build/libs/passfault-core-0.8-SNAPSHOT.jar yields:

Exception in thread "main" java.io.IOException: could not load resource /org/owasp/passfault/wordlists/words.properties at org.owasp.passfault.FinderByPropsBuilder$SystemResourceReader.loadResource(FinderByPropsBuilder.java:231) at org.owasp.passfault.FinderByPropsBuilder.build(FinderByPropsBuilder.java:97) at org.owasp.passfault.TextAnalysis.<init>(TextAnalysis.java:49) at org.owasp.passfault.TextAnalysis.main(TextAnalysis.java:42)

apbryan commented 9 years ago

I unpacked the generated jar and copied the contents of wordlists/wordlists into org/owasp/passfault/wordlists/ and packed a new jar file. This got rid of the error, but the application was unable to detect words.

Output of my mangled manually crafted jar: Word Count:1638 Word Count:5815 Word Count:78772 Word Count:37 Word Count:218 Word Count:266 Word Count:506 Word Count:1945 Word Count:18386 Word Count:111903 Word Count:516 Word Count:587 Word Count:1604 Word Count:248 Word Count:714 Word Count:7917 Word Count:101939 Word Count:214 Word Count:351 Word Count:2000 Word Count:5408 Word Count:11621 Word Count:134653 Please enter a password: (Enter 'q' to exit) apple
Most crackable combination of finders: 'apple' matches the pattern 'Random Characters with:[Latin]' 12 million passwords in the pattern 100.00 percent of password strength Total passwords in all finders: 12 million Estimated time to crack with 100 GPU(s): less than 1 day Analysis Time: 0.184000 seconds

I suppose the Word Counts at the beginning show the wordlists were found, but are not being used?

c-a-m commented 9 years ago

Sorry for not seeing this issue earlier. I just updated my email settings. I'll get looking at it.

c-a-m commented 9 years ago

I updated the build instructions to use the gradlew wrapper. @apbryan would you mind trying this again to see if everything builds for you? Never mind. I've still some work to do on this.

c-a-m commented 9 years ago

So the wordlist.jar is a dependency of the passfault-core jar in this newer build. I'm not sure if we want to keep it that way or not. Regardless we should update the documentation on how to run it.

I tried using gradle run, but apparently there is a bug regarding it: https://issues.gradle.org/browse/GRADLE-2310 That prevents us from reading from the console or System.in

bernardoaraujor commented 8 years ago

I'm having a similar issue. I'm trying to import the project into IntelliJ+Gradle.

When Gradle tries to build it, I get the following message:

Expected configuration ':jsonService:wordlists' to contain exactly one file, however, it contains no files. Consult IDE log for more details (Help | Show Log)

bernardoaraujor commented 8 years ago

same thing with command line:

bernardo@bernardo-UX51VZA:~/Documents/MestradoCripto/passfault/passfaultJava$ ./gradlew installDist

FAILURE: Build failed with an exception.

BUILD FAILED

Total time: 4.886 secs

bernardoaraujor commented 8 years ago

worked after i deleted appEngine and jsonService directories