[zomgwtfbbq]

I've created some time ago an algorithm for creating passwords based on user input. The basic idea is that a user submits keywords through an html form. Example: dog, johndoe, ajax, strawberry.

The generator will use these words and bind them to other words like: 123, qwerty etc. Also it will perform some string manipulation on the words.

Although you will need my cms to get it to work, I wanted Deque to take a look at it as I promised to post it. I thought it might be useful to other users as well so here it is. Like I said it won't work straight out of the box, you need the cms in my signature.

PHP Code:

<?php
/* Word generator

Generates words based on specified words

PARAMETERS:
$aWords: words to use for generating

RETURNS:
ARRAY: words that will be created for generating passwords
*/
function CreateWords($aWords){
    // first three chars of each word
    $aFirstThreeChars = array();
    $aFirstThreeCharsLC = array();
    $aFirstThreeCharsUC = array();
    $aFirstThreeCharsNH = array();
    $aFirstThreeCharsNU = array();
    // full words
    $aFullWords = array();
    for($x=0;$x<count($aWords);$x++){
        if(strlen($aWords[$x])>2){
            $sWord = trim($aWords[$x]);
            $sWordTrim = substr($sWord,0,3);
            if(strlen($sWord)<3 || strlen($sWordTrim)<3){
                continue;
            }
            $aFirstThreeChars[] = $sWordTrim;
            $aFirstThreeCharsLC[] = strtolower($sWordTrim);
            $aFirstThreeCharsUC[] = strtoupper($sWordTrim);
            $aFirstThreeCharsNH[] = str_replace("-","",$sWordTrim);
            $aFirstThreeCharsNU[] = str_replace("_","",$sWordTrim);
            $aFullWords[] = $sWord;
            $aFullWords[] = strrev($sWord);
            $aFullWords[] = str_replace("-","",$sWord);
            $aFullWords[] = str_replace(" ","",$sWord);
            $aFullWords[] = str_replace("_","",$sWord);
        }
    }
    $aFirstThreeChars = array_unique(array_merge($aFirstThreeChars,$aFirstThreeCharsLC,$aFirstThreeCharsUC,$aFirstThreeCharsNH,$aFirstThreeCharsNU));
    // first three chars of each word reverse
    $aFirstThreeCharsRev = array();
    for($x=0;$x<count($aFirstThreeChars);$x++){
        $aFirstThreeCharsRev[] = @strrev($aFirstThreeChars[$x]);
    }
    return(array_unique(array_merge($aFirstThreeChars,$aFirstThreeCharsRev,$aFullWords)));
}

/* Password generator

Generates passwords based on specified words

PARAMETERS:
$aWords: words to use for generating
$aCommon: common words from common.php

RETURNS:
VOID: data is globally used
*/

function CreatePasses($aWords,$aCommon){
    global $sBuffer;
    $iWords = count($aWords);
    $iCommon = count($aCommon);
    for($x=0;$x<$iWords;$x++){
        $sWord = @trim($aWords[$x]);
        if($sWord!=""){
            $sBuffer .= $sWord."\n";
        }
    }
    $aData = array();
    $aData[0] = array("iCommon","iCommon","iCommon");
    $aData[1] = array("iCommon","iCommon","iWords");
    $aData[2] = array("iCommon","iWords","iCommon");
    $aData[3] = array("iCommon","iWords","iWords");
    $aData[4] = array("iWords","iWords","iWords");
    $aData[5] = array("iWords","iCommon","iWords");
    $aData[6] = array("iWords","iWords","iCommon");
    $aData[7] = array("iCommon","iCommon");
    $aData[8] = array("iCommon","iWords");
    $aData[9] = array("iWords","iWords");
    $aData[10] = array("iWords","iCommon");
    // combinations
    foreach($aData as $iKey=>$aValues){
        // word 1
        $sTempRoot = "";
        for($x=0;$x<${$aData[$iKey][0]};$x++){
            $sTempRoot = @${str_replace("i","a",$aData[$iKey][0])}[$x];
            if(isset($aData[$iKey][1])){
                // word 2
                for($y=0;$y<${$aData[$iKey][1]};$y++){
                    $sTempSub1 = "";
                    if(!isset($aData[$iKey][2])){
                        $sBuffer .= $sTempRoot.@${str_replace("i","a",$aData[$iKey][1])}[$y]."\n";
                    }
                    else{
                        $sTempSub1 = @${str_replace("i","a",$aData[$iKey][1])}[$y];
                    }
                    if(isset($aData[$iKey][2])){
                        // word 3
                        for($z=0;$z<${$aData[$iKey][2]};$z++){
                            $sBuffer .= $sTempRoot.$sTempSub1.@${str_replace("i","a",$aData[$iKey][2])}[$z]."\n";
                        }
                    }
                }
            }
        }
    }
    $sBuffer = str_replace("\n\n","\n",$sBuffer);
}
?>

[Deque]

Thanks for the code.
I am trying to understand what you are doing. Correct me if I am wrong. I am not a PHP coder.

You take some words from the user as input and I suspect you have another wordlist with common words from common.php. You concatenate these common words and the user words to get new words.

I am not quite sure about the CreateWords function, but it takes the first three characters of each word puts them together with the reversed first three characters and concatenates them with the full words.

[zomgwtfbbq]

Thanks for the code.
I am trying to understand what you are doing. Correct me if I am wrong. I am not a PHP coder.

You take some words from the user as input and I suspect you have another wordlist with common words from common.php. You concatenate these common words and the user words to get new words.

I am not quite sure about the CreateWords function, but it takes the first three characters of each word puts them together with the reversed first three characters and concatenates them with the full words.

Correct.

[Deque]

Thanks. I think it is a good idea in general to use words related to a person and scramble them together to create wordlists.
I have never thought of that.

[zomgwtfbbq]

Thanks. I think it is a good idea in general to use words related to a person and scramble them together to create wordlists.
I have never thought of that.

Lots of people are creating passwords like this. I managed to crack my wife's password by just knowing her favorite food(cheesecake) and her date of birth(2-11-1983) => cheesecake211