Menu

Brute Force Techniques in Golang

How to create password brute force wordlist generator tool in Golang?

While trying to penetrate a web application, we often see passwords are a barrier to the sensitive information of a user or an organization. Now we need to bypass passwords somehow. So, there are mainly two approaches for us: either find a vulnerability in webapp authrising or guess (Brute Force) the right password.

How to start make a Golang program?

Let's use some mathematics that we learnt in high school. Recall permutation and combination (P&C), here we have a list of characters and we have to choose some of them (=passwordLength) with every possible method (combination). Also for every method (combination) we can arrange those characters in many unique ways.

> If we use this approach and use google we can find itertools module to make our work easy.

1. Start by creating a file **main.go** and import the required Golang packages:

  • fmt - To print passwords.
  • strconv - strings manipulation functions
  • strings - To manipulate UTF-8 encoded strings.
  • github.com/ernestosuarez/itertools - .permutation and combination of characters list
package main

import    (
    // To print passwords.
    "fmt"
    
    // strings manipulation functions
    "strings"

    // convert string types to int types
    "strconv"


    // permutation and combination of charactersList
    "github.com/ernestosuarez/itertools"
)

2. Declare variables in Golang

Now, we can declare required variables in the main() function.

  • passwordLenth - length of generated password.
  • characters - character to compose the password.
func main()  {


    // The password length
    passwordLength := "1,2,4"

    // character to compose the password
    characters := "abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()+-./"


}

3. String manipulation in Golang

Here, both variables are supposed to be an array.

  • passwordLengthList - split it into an array from every ',' character.
  • charactersList - Use characters string to create an array of all characters.
func main()  {


    // The password length
    passwordLength := "1,2,4"

    // character to compose the password
    characters := "abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()+-./"


    // Split comma separated password length into slice.
    passwordLengthList := strings.Split(passwordLength, ",")
    
    // Splits a string into a list of strings.
    charactersList := strings.Split(characters, "")


}

4. Create **for** loop in Golang

To generate passwords for all lengths in the array passwordLengthList, we need to use a for loop.

func main()  {


    // The password length
    passwordLength := "1,2,4"

    // character to compose the password
    characters := "abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()+-./"


    // Split comma separated password length into slice.
    passwordLengthList := strings.Split(passwordLength, ",")
    
    // Splits a string into a list of strings.
    charactersList := strings.Split(characters, "")


    // run permations for every password length.
    for _, passLen := range passwordLengthList {
    

        // convert integer strings to int.
        passLenInt, err := strconv.Atoi(passLen)
        
        // If an error is nil panic.
        if err != nil {
            panic(err)
        }
        
    }
}

5. Permutation and Combination in Golang

itertools provides a function that takes an array and length integer to calculate all different password strings that could be generated by these character arrays.

Take a look at this example use of itertools for reference.

func main()  {

    iterable := []string{"1", "2", "3", "4"}

    for v := range PermutationsStr(iterable, 3) {
        fmt.Println(v)
    }

}

6. Create brute force list generator in Golang

Let's use every piece to solve this puzzle to get a working program.

package main

import    (
    // To print passwords.
    "fmt"
    
    // strings manipulation functions
    "strings"

    // convert string types to int types
    "strconv"

    
    // permutation and combination of charactersList
    "github.com/ernestosuarez/itertools"
)


func main()  {


    // The password length
    passwordLength := "1,2,4"

    // character to compose the password
    characters := "abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()+-./"


    // Split comma separated password length into slice.
    passwordLengthList := strings.Split(passwordLength, ",")
    
    // Splits a string into a list of strings.
    charactersList := strings.Split(characters, "")


    // run permations for every password length.
    for _, passLen := range passwordLengthList {
    

        // convert integer strings to int.
        passLenInt, err := strconv.Atoi(passLen)
        
        // If an error is nil panic.
        if err != nil {
            panic(err)
        }


        // Prints a list of permutations of the characters.
        for v := range itertools.PermutationsStr(charactersList, passLenInt) {
            
            // Prints a string by joining all elements of the list.
            fmt.Println(strings.Join(v, ""))

        }
        
    }
}

Conclusion

In this tutorial we made a Golang program to generate a brute force wordlist with specific characters and length used.