A wordlist generator for security testing that creates permutations of known data to crack tokens.
Token Reverser is a Python-based wordlist generator designed to crack security tokens by permuting known user data and timestamps. It helps security testers reverse-engineer how tokens are constructed, such as those used in password reset flows, by generating targeted wordlists for hash-cracking tools like hashcat.
Penetration testers, security researchers, and red teamers who need to analyze and crack security tokens during vulnerability assessments.
It automates the tedious process of creating permutations from known data, saving time and increasing the success rate of cracking tokens compared to generic wordlists.
Words list generator to crack security tokens
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Automates generation of wordlists specifically for reverse-engineering security tokens from known user data and timestamps, as shown in the password reset example where it cracked an MD5 hash.
Incorporates timestamps from HTTP headers with configurable offsets, allowing for time variations in token generation, which is critical for accurate cracking in real-world scenarios.
Tests a wide range of separators by default, including special characters and whitespace, covering common token concatenation patterns without manual setup.
Outputs wordlists directly compatible with hashcat, streamlining the workflow from data permutation to hash cracking, as demonstrated in the example use case.
Effectiveness is heavily dependent on having accurate and complete user information; missing or incorrect data can render the tool ineffective, limiting its use in blind attacks.
Assumes tokens are constructed via simple concatenation and hashing, making it unsuitable for more secure methods like salted hashes, encryption, or complex algorithms.
Lacks a GUI or advanced features, which may be less accessible for users who prefer visual tools or need to manage large datasets interactively, relying solely on terminal commands.