CUPP
GPL-3.0๐ Password Attacks ยท Python
CUPP (Common User Passwords Profiler) is a tool that generates custom wordlists based on information gathered about a target individual. Rather than using generic wordlists, CUPP creates targeted password lists by taking inputs like the target's name, birthday, partner's name, pet's name, company, and other personal details, then generating thousands of password permutations using common patterns people use when creating passwords. It applies rules like capitalizing first letters, appending birth years, combining names with special characters, leetspeak substitutions, and other patterns observed in real-world password creation habits. CUPP also supports downloading and parsing existing leaked wordlists and can generate wordlists from OSINT data. The philosophy is simple: people are predictable, and targeted wordlists are far more effective than brute force against human-chosen passwords.
Installation
from source
$ git clone https://github.com/Mebus/cupp.git && cd cupp && python3 cupp.py -hUse Cases
- Generating targeted wordlists from OSINT about specific individuals
- Creating password lists based on personal information for penetration testing
- Testing organizational password policies against profiled attack wordlists
- Combining with hashcat or John the Ripper for targeted credential attacks
- Demonstrating password predictability in security awareness training
Tags
Details
- Category
- ๐ Password Attacks
- Language
- Python
- Repository
- Mebus/cupp
- License
- GPL-3.0
- Platforms
- ๐งlinux๐macos๐ชwindows
Links
Alternatives & Comparisons
John the Ripper
CFast password cracker. Supports hundreds of hash types and ciphers. CPU and GPU modes.
Compare CUPP vs John the RipperHashcat
CWorld's fastest password recovery tool. GPU-accelerated with support for 300+ hash types.
Compare CUPP vs HashcatMore in Password Attacks
John the Ripper
CFast password cracker. Supports hundreds of hash types and ciphers. CPU and GPU modes.
Hashcat
CWorld's fastest password recovery tool. GPU-accelerated with support for 300+ hash types.
THC Hydra
CFast online password brute-forcer. Supports 50+ protocols including SSH, FTP, HTTP, SMB, MySQL.
Medusa
CSpeedy, parallel, modular brute-forcer. Supports HTTP, MySQL, SMB, SSH, Telnet, and more.
CeWL
RubyCustom wordlist generator. Spiders a target site and builds password lists from scraped words.
SecLists
ShellThe security tester's companion. Huge collection of wordlists - usernames, passwords, URLs, fuzzing payloads, shells.