Generate weak password lists from personal data for security testing
CUPP simulates attack scenarios where passwords are guessed based on personal details like birthdays, nicknames, or pet names. It is a wordlist generator that takes user profile information as input and produces various password candidates derived from that data. This allows you to identify weak password patterns that might be used in penetration testing or forensic investigations.
Password guessing based on personal information
People often set their passwords using their birthdays, addresses, family names, or common words like 'love' and 'password'. CUPP mimics attack methods that exploit these human habits. When you enter basic information such as a user's name or date of birth, it automatically generates password candidates by combining or modifying that data. This process goes beyond simply listing words; it is closer to a profiling exercise that analyzes patterns a user is likely to employ.
Various input sources and processing methods
CUPP can create password lists in several different ways.
- Interactive profiling It asks the user direct questions to collect personal information and generates passwords based on those answers.
- Existing dictionary conversion It accepts existing wordlists or output from other tools as input to perform additional modifications and expansions.
- Alecto DB integration It parses a database of refined usernames and passwords to construct an initial attack list.
Execution environment and installation
Running CUPP requires a Python 3 environment. After cloning the repository, you can view available options by running the python3 cupp.py -h command. You can also adjust specific behaviors through the configuration file cupp.cfg.
Legal scope to verify before use
CUPP is designed for use in legitimate penetration testing or forensic investigations such as criminal inquiries. Therefore, you must ensure you have explicit authorization and legal grounds for the target system before using this tool. Using this tool on someone else's account or network without permission may constitute illegal intrusion. Additionally, this program is free software distributed under the GNU General Public License v3, with no warranty provided for fitness for a particular purpose or commercial use.
