CUPP

Password Attacks

Beginnerlow risk

CUPP (Common User Passwords Profiler) creates custom wordlists based on target personal information like names, birthdays, nicknames, pets, and keywords.

Installation

git clone https://github.com/Mebus/cupp.git

Basic Syntax

python3 cupp.py -i

Quick Facts

Full Name

CUPP (Common User Passwords Profiler)

License

GPLv3

Author

Mebus

Written In

Python

Platforms

Linux, macOS, Windows

Category

Wordlist Generation

Input Method

Interactive profiling / OSINT

Key Feature

Personal information-based wordlists

Tool Overview

CUPP (Common User Passwords Profiler) is a Python-based tool that generates personalized wordlists based on information about a specific target. Unlike generic wordlists, CUPP creates dictionaries using the target's name, birthday, pet names, and other personal details.

CUPP works by interactively collecting information about the target — including names, birthdates, partners, children, pets, and company details — then generating password variations based on common password patterns people use with personal information.

For social engineering engagements, CUPP is invaluable. People often use personal information in their passwords (like birthdates, pet names, or anniversaries), and CUPP systematically generates these variations for highly targeted password attacks.

Common Commands

cupp -hShow CUPP usage and all available options

cupp --helpDisplay the full help text for CUPP

cupp -iStart interactive mode to profile a target's password wordlist

cupp --interactiveRun the guided interactive questionnaire (long form)

cupp -w existing.txtImprove an existing dictionary with word mangling

cupp -lDownload huge premade wordlists from the repository

cupp -aParse default vendor usernames and passwords from the Alecto DB

cupp -vShow the CUPP version

cupp --versionPrint the program version (long form)

cupp -qRun in quiet mode without printing the banner

cupp -q -iInteractive profiling with the banner suppressed

python3 cupp.py -iRun CUPP directly from the cloned source in interactive mode

git clone https://github.com/Mebus/cupp.gitClone the CUPP source repository

sudo apt install cuppInstall CUPP from the Kali repositories

cupp -w /path/to/fileFeed a WyD.pl or wordlist file for enhancement

Step-by-Step Guide

1Collect background intelligence on your subject
2Start the script and select the interactive option
3Provide the requested details into the terminal prompts
4Examine the finalized output file
5Deploy this highly targeted list in your subsequent attacks

Warnings

Only utilize this methodology during sanctioned engagements
This tool relies on psychological predictability
Always adhere to strict privacy guidelines

Use Cases

Social Engineering

Generate wordlists from target's personal information gathered through OSINT.

Targeted Penetration Testing

Create personalized dictionaries for specific individuals during authorized engagements.

Password Policy Auditing

Test whether employees use personal information in their passwords.

CTF Challenges

Solve challenges requiring personal information-based password cracking.

Red Team Operations

Build targeted wordlists from OSINT data for credential attacks.

Key Features

Interactive Profiling: Guided questions to collect comprehensive target information.
Password Patterns: Generates common patterns: name+year, pet+numbers, company+123.
Wordlist Enhancement: Add permutations to existing wordlists with -w flag.
Database Downloads: Download common password lists and Alecto default credentials.
Simple Python Script: Minimal dependencies, runs on any system with Python.
OSINT Integration: Works with information gathered from social engineering reconnaissance.

Output Explanation

Produces a customized dictionary file containing variations and combinations of the subject's personal data.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.