search

lmammino / jwt-cracker

Simple HS256, HS384 & HS512 JWT token brute force cracker.
https://lmammino.github.io/jwt-cracker/
MIT License
1.05k stars 165 forks source link

Use password attempts from files (e.g. rockyou or top 1000) #4

Open global4g opened 7 years ago

global4g commented 7 years ago

Is it possible to brute-force based on a predefined password file ?

lmammino commented 7 years ago

Thanks for checking out this project.

No this feature is currently not supported and it's on my personal radar. Anyway, this is supposed to be a proof of concept, so the code should be simple enough to allow everybody to submit new features like the one you described.

Let me know if you are interested in implementing something like this, maybe i can give you some insight if needed.

On Nov 25, 2017 19:36, "global4g" notifications@github.com wrote:

Is it possible to brute-force based on a predefined password file ?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/lmammino/jwt-cracker/issues/4, or mute the thread https://github.com/notifications/unsubscribe-auth/AAMjPYvnejB-9sHrrXzye_tvFNDCCUQtks5s6F4qgaJpZM4Qqg-s .

global4g commented 7 years ago

Thanks for your quick response. yes I might be interested to give this a shot. Not much experience in node as such but familiar with crypto, hmac stuff. Will check the source code. if you have any words of advice, i would appreciate that. Thanks again!

lmammino commented 7 years ago

Sure, super happy to help on this.

So this is the current main logic: https://github.com/lmammino/jwt-cracker/blob/master/index.js#L54-L69

Here we basically use the variations-stream library to generate all the possible variations of strings over an alphabet.

Every variation string is pushed to the stream, so we use the on('data') event to get the current string.

If you change the source string to push the data from a file line by line, the rest of the code should remain pretty much the same. Check byline, if you need a quick win on reading a file line by line using a streamable interface.

I hope that's useful!