Practical PCFG Password Cracking
Explains how Probabilistic Context-Free Grammars (PCFGs) model human password creation patterns to generate highly effective cracking guesses.
Summary
Matt Weir presents practical applications of Probabilistic Context-Free Grammars (PCFG) for advanced password cracking. He contrasts traditional dictionary and brute-force approaches against structural grammar analysis, explaining how human password creation follows predictable linguistic, semantic, and keyboard patterns that can be modeled probabilistically to generate highly targeted guess lists.
Weir discusses the internal mechanics of the open-source PCFG toolset at 12:11, explaining how training sets transform into probabilistic grammar rules combining base words, character replacements, and digit appendages. At 17:56 and 21:04, he demonstrates optimizing rule generation and evaluating metric coverage (24:02) to maximize cracking efficiency while minimizing duplicate guesses (40:03). He emphasizes tuning training corpora against target organizations (37:04) to crack complex corporate passwords that standard wordlists miss.
(AI summary — Gemini Flash)
Related talks
Password Village·24 min
PNI
A walkthrough demonstrating core Hashcat attack modes, rule manipulation, and dictionary optimization.
Password Village·1 hr 50 min
A live demonstration of combinatorial and statistical attacks to crack rockyou.txt hashes from scratch without using the wordlist.
Password Village·24 min
PNI
An introductory guide to setting up and running Hashcat for GPU-accelerated password recovery and hash analysis.