Brute Force Techniques in Golang
How to create password brute force wordlist generator tool in Golang?
While trying to penetrate a web application, we often see passwords are a barrier to the sensitive information of a user or an organization. Now we need to bypass passwords somehow. So, there are mainly two approaches for us: either find a vulnerability in webapp authrising or guess (Brute Force) the right password.
How to start make a Golang program?
Let's use some mathematics that we learnt in high school. Recall permutation and combination (P&C), here we have a list of characters and we have to choose some of them (=passwordLength) with every possible method (combination). Also for every method (combination) we can arrange those characters in many unique ways.
> If we use this approach and use google we can find itertools module to make our work easy.
1. Start by creating a file **main.go** and import the required Golang packages:
fmt- To print passwords.strconv- strings manipulation functionsstrings- To manipulate UTF-8 encoded strings.github.com/ernestosuarez/itertools- .permutation and combination of characters list
package main
import (
// To print passwords.
"fmt"
// strings manipulation functions
"strings"
// convert string types to int types
"strconv"
// permutation and combination of charactersList
"github.com/ernestosuarez/itertools"
)2. Declare variables in Golang
Now, we can declare required variables in the main() function.
passwordLenth- length of generated password.characters- character to compose the password.
func main() {
// The password length
passwordLength := "1,2,4"
// character to compose the password
characters := "abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()+-./"
}3. String manipulation in Golang
Here, both variables are supposed to be an array.
passwordLengthList- split it into an array from every ',' character.charactersList- Usecharactersstring to create an array of all characters.
func main() {
// The password length
passwordLength := "1,2,4"
// character to compose the password
characters := "abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()+-./"
// Split comma separated password length into slice.
passwordLengthList := strings.Split(passwordLength, ",")
// Splits a string into a list of strings.
charactersList := strings.Split(characters, "")
}4. Create **for** loop in Golang
To generate passwords for all lengths in the array passwordLengthList, we need to use a for loop.
func main() {
// The password length
passwordLength := "1,2,4"
// character to compose the password
characters := "abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()+-./"
// Split comma separated password length into slice.
passwordLengthList := strings.Split(passwordLength, ",")
// Splits a string into a list of strings.
charactersList := strings.Split(characters, "")
// run permations for every password length.
for _, passLen := range passwordLengthList {
// convert integer strings to int.
passLenInt, err := strconv.Atoi(passLen)
// If an error is nil panic.
if err != nil {
panic(err)
}
}
}5. Permutation and Combination in Golang
itertools provides a function that takes an array and length integer to calculate all different password strings that could be generated by these character arrays.
Take a look at this example use of itertools for reference.
func main() {
iterable := []string{"1", "2", "3", "4"}
for v := range PermutationsStr(iterable, 3) {
fmt.Println(v)
}
}6. Create brute force list generator in Golang
Let's use every piece to solve this puzzle to get a working program.
package main
import (
// To print passwords.
"fmt"
// strings manipulation functions
"strings"
// convert string types to int types
"strconv"
// permutation and combination of charactersList
"github.com/ernestosuarez/itertools"
)
func main() {
// The password length
passwordLength := "1,2,4"
// character to compose the password
characters := "abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()+-./"
// Split comma separated password length into slice.
passwordLengthList := strings.Split(passwordLength, ",")
// Splits a string into a list of strings.
charactersList := strings.Split(characters, "")
// run permations for every password length.
for _, passLen := range passwordLengthList {
// convert integer strings to int.
passLenInt, err := strconv.Atoi(passLen)
// If an error is nil panic.
if err != nil {
panic(err)
}
// Prints a list of permutations of the characters.
for v := range itertools.PermutationsStr(charactersList, passLenInt) {
// Prints a string by joining all elements of the list.
fmt.Println(strings.Join(v, ""))
}
}
}Conclusion
In this tutorial we made a Golang program to generate a brute force wordlist with specific characters and length used.










