A Rust tool that machine-learns efficient password mangling rules for John the Ripper or Hashcat from a dictionary and password list.
rulesfinder is a Rust-based tool that automatically generates efficient password mangling rules for password-cracking utilities like John the Ripper and Hashcat. It analyzes a dictionary and a list of cleartext passwords to discover patterns and create rules that maximize cracked passwords, addressing the need for optimized, data-driven rule generation in security testing.
Security professionals, penetration testers, and red teamers who need to generate effective password-cracking rules for assessments or research, particularly those working with large password datasets.
It automates the tedious process of manual rule creation by applying machine learning techniques to real password data, producing rules that are more likely to succeed in cracking scenarios while offering configurability to balance performance and rule quality.
Machine-learn password mangling rules
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses machine learning to analyze real password patterns, generating rules that efficiently crack passwords from given datasets, as described in its algorithmic approach.
Outputs rules directly usable by John the Ripper and Hashcat, integrating seamlessly into standard password-cracking workflows without additional conversion.
Allows adjustment of parameters like minsize and thread count, with a performance table in the README showing memory usage trade-offs for different settings.
Includes practical recommendations, such as using real passwords and appropriate dictionary sizes, to avoid generating rules that don't generalize well.
Admits to significant RAM usage, with examples in the README showing up to 14GB for 3.8M cleartext words, making it unsuitable for low-resource systems.
Labeled as alpha, meaning it may have bugs, lack features, or undergo breaking changes, with limited stability for critical use cases.
Requires Rust toolchain installation, manual memory limits via ulimit, and careful parameter tuning, adding overhead compared to plug-and-play tools.