fiddlesticks 0.1.0__tar.gz → 0.2.0__tar.gz

fiddlesticks-0.2.0/.gitattributes

@@ -0,0 +1,3 @@
+* text eol=lf
+*.kdbx binary
+*.kdbx -text -diff

{fiddlesticks-0.1.0 → fiddlesticks-0.2.0}/.github/workflows/tests.yml

@@ -18,6 +18,7 @@ jobs:
           "test_aegis_checker_from_CLI",
           "test_aegis_checker_errors_from_CLI",
           "test_aegis_checker_against_avdu_vault",
+          "test_pykeepass_checker_against_Test_vault",
         ]
     steps:
     - name: Check out repo
@@ -30,7 +31,7 @@ jobs:
     
     - name: Install dependencies
       run: |
-        pip install -e .[tests,py7zr,aegis]
+        pip install -e .[tests,py7zr,aegis,keepassxc]
 
     - name: Run PyTest
       run: |

{fiddlesticks-0.1.0 → fiddlesticks-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fiddlesticks
-Version: 0.1.0
+Version: 0.2.0
 Summary: Password recovery tool for encrypted archives (currently only .7z files supported).
 Project-URL: GitHub, https://github.com/Hazardous-Area/fiddlesticks
 Author-email: James Parrott <james@jamesparrott.dev>
@@ -9,6 +9,8 @@ License-File: LICENSE
 Requires-Python: >=3.12
 Provides-Extra: aegis
 Requires-Dist: py-avdu; extra == 'aegis'
+Provides-Extra: keepassxc
+Requires-Dist: pykeepass; extra == 'keepassxc'
 Provides-Extra: py7zr
 Requires-Dist: py7zr; extra == 'py7zr'
 Provides-Extra: tests
@@ -20,6 +22,8 @@ Description-Content-Type: text/markdown
 *"Aaaagh!  I forgot my 7zip password"* - James (more times than he cares to remember).
 ![Tests passing](https://github.com/Hazardous-Area/fiddlesticks/actions/workflows/tests.yml/badge.svg)
 
+Version 0.2.0 
+
 ## Description
 Password recovery tool, for password-encrypted files, using simple off-line brute 
 force attacks.  Password candidates are generated, using common variations 
@@ -62,23 +66,27 @@ archive can also do so - the password wasn't strong enough.
  the user to share the guesses for their passwords with the service.  Even if the password
  was not used for anything else, sharing even guesses for secret credentials with 3rd parties, 
  is a critical security issue.
- - Fiddlesticks is designed to minimise the need for this.  It is designed to both i) require as 
- few dependencies as possible, and ii) be as easy to install as possible.  
- The intention is ii) assists users to run Fiddlesticks in their own secure
- environment, locked down as much as they want, without requiring them to take their 
- password guesses outside of that.  Only stock 7zip is required.  Fiddlesticks can even 
- generate a file of candidate passwords, for any possible application.  Secondly
- i) helps users decide for themselves whether or not to trust Fiddlesticks 
+ - Fiddlesticks is designed to minimise the need for this.  It is designed to i) be as easy 
+ to install as possible, and in particular ii) require as few dependencies as possible.  
+ Firstly, the intention of i) is to assist users to run Fiddlesticks in their own secure
+ environment, locked down as much as they want (e.g. offline and disconnected from 
+ all external network access), without requiring them to take their 
+ password guesses outside of that.  For example, for recovery of password encrypted .7z archives,
+ only a normal installation of 7zip is required on Linux (plus a close enough guess of the password!).
+ Fiddlesticks can even generate a file of candidate passwords, for external programs, and other 
+ possible applications.  Secondly, ii) helps users decide for themselves whether or not to trust Fiddlesticks 
  in the first place.  In particular whether or not it will take their password guesses outside
  of its running environment.  When the project was concieved, the intention was also to 
  iii) require as little code as possible.  But the code base has since become somewhat more 
- complex, mainly in order to have a nice CLI.  Simplicity and brevity should both be much 
- more highly prized features of any software, than they are.  But you 
- be the judge of whether or not c) is still the case.  It's only a single ~500 line file.
+ complex, mainly to have a nice CLI.  Simplicity and brevity should both be much 
+ more highly prized features of software in general.  But you 
+ be the judge of whether or not c) is still the case.  The application code is all in a 526 line file.
 
 ### Usage
 Recommended use is simply to automate attempts to open a 7z archive via the user's own 7zip.
-Fiddlesticks can also try to decrypt Aegis vault files (for TOTP authenticators) if [py-avdu](https://pypi.org/project/py-avdu/) is also installed.
+Fiddlesticks can also try to decrypt KeepassXC vaults and Aegis vault files (for TOTP authenticators) if 
+[pykeepass](https://pypi.org/project/pykeepass/) and [py-avdu](https://pypi.org/project/py-avdu/) respectively, are 
+also installed.
 
 There are a couple of alternative modes too, firstly: automating any other external Bash command that a candidate password can be appended to (that obeys the normal return code convention).
 

{fiddlesticks-0.1.0 → fiddlesticks-0.2.0}/README.md

@@ -2,6 +2,8 @@
 *"Aaaagh!  I forgot my 7zip password"* - James (more times than he cares to remember).
 ![Tests passing](https://github.com/Hazardous-Area/fiddlesticks/actions/workflows/tests.yml/badge.svg)
 
+Version 0.2.0 
+
 ## Description
 Password recovery tool, for password-encrypted files, using simple off-line brute 
 force attacks.  Password candidates are generated, using common variations 
@@ -44,23 +46,27 @@ archive can also do so - the password wasn't strong enough.
  the user to share the guesses for their passwords with the service.  Even if the password
  was not used for anything else, sharing even guesses for secret credentials with 3rd parties, 
  is a critical security issue.
- - Fiddlesticks is designed to minimise the need for this.  It is designed to both i) require as 
- few dependencies as possible, and ii) be as easy to install as possible.  
- The intention is ii) assists users to run Fiddlesticks in their own secure
- environment, locked down as much as they want, without requiring them to take their 
- password guesses outside of that.  Only stock 7zip is required.  Fiddlesticks can even 
- generate a file of candidate passwords, for any possible application.  Secondly
- i) helps users decide for themselves whether or not to trust Fiddlesticks 
+ - Fiddlesticks is designed to minimise the need for this.  It is designed to i) be as easy 
+ to install as possible, and in particular ii) require as few dependencies as possible.  
+ Firstly, the intention of i) is to assist users to run Fiddlesticks in their own secure
+ environment, locked down as much as they want (e.g. offline and disconnected from 
+ all external network access), without requiring them to take their 
+ password guesses outside of that.  For example, for recovery of password encrypted .7z archives,
+ only a normal installation of 7zip is required on Linux (plus a close enough guess of the password!).
+ Fiddlesticks can even generate a file of candidate passwords, for external programs, and other 
+ possible applications.  Secondly, ii) helps users decide for themselves whether or not to trust Fiddlesticks 
  in the first place.  In particular whether or not it will take their password guesses outside
  of its running environment.  When the project was concieved, the intention was also to 
  iii) require as little code as possible.  But the code base has since become somewhat more 
- complex, mainly in order to have a nice CLI.  Simplicity and brevity should both be much 
- more highly prized features of any software, than they are.  But you 
- be the judge of whether or not c) is still the case.  It's only a single ~500 line file.
+ complex, mainly to have a nice CLI.  Simplicity and brevity should both be much 
+ more highly prized features of software in general.  But you 
+ be the judge of whether or not c) is still the case.  The application code is all in a 526 line file.
 
 ### Usage
 Recommended use is simply to automate attempts to open a 7z archive via the user's own 7zip.
-Fiddlesticks can also try to decrypt Aegis vault files (for TOTP authenticators) if [py-avdu](https://pypi.org/project/py-avdu/) is also installed.
+Fiddlesticks can also try to decrypt KeepassXC vaults and Aegis vault files (for TOTP authenticators) if 
+[pykeepass](https://pypi.org/project/pykeepass/) and [py-avdu](https://pypi.org/project/py-avdu/) respectively, are 
+also installed.
 
 There are a couple of alternative modes too, firstly: automating any other external Bash command that a candidate password can be appended to (that obeys the normal return code convention).
 

{fiddlesticks-0.1.0 → fiddlesticks-0.2.0}/pyproject.toml

@@ -16,9 +16,11 @@ dynamic=["version"]
 dependencies = []
 
 [project.optional-dependencies]
-tests = ["pytest", "hypothesis",]
-py7zr = ["py7zr",]
-aegis = ["py-avdu",]
+py7zr = ["py7zr"]
+aegis = ["py-avdu"]
+keepassxc = ["pykeepass"]
+tests = ["pytest", "hypothesis"]
+
 
 [project.urls]
 GitHub = "https://github.com/Hazardous-Area/fiddlesticks"

{fiddlesticks-0.1.0 → fiddlesticks-0.2.0}/src/fiddlesticks.py

@@ -2,13 +2,14 @@
 # requires-python = ">=3.12"
 # dependencies = []
 # optional_dependencies = [
-#   tests = ["pytest", "hypothesis"],
 #   py7zr = ["py7zr"],
 #   aegis = ["py-avdu"],
+#   keepassxc = ["pykeepass"],
+#   tests = ["pytest", "hypothesis"],
 # ]
 # ///
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 
 import argparse
 import atexit
@@ -268,6 +269,21 @@ def make_py_avdu_aegis_checker(file: str, **kwargs):
 
     return checker
 
+def make_pykeepass_checker(file: str, **kwargs):
+
+    from pykeepass import PyKeePass
+    from pykeepass.exceptions import CredentialsError
+
+    def checker(candidate: str) -> bool:
+        try:
+            PyKeePass(file, password=candidate)
+            return True
+        except CredentialsError:
+            return False
+        
+
+    return checker
+
 
 def test_passwords_sequentially(
     candidates: Iterable[str],
@@ -305,6 +321,8 @@ def test_passwords_sequentially(
 default_password_protected_file_checker_factories = {
     ".7z" : make_7zip_checker,
     ".json" : make_py_avdu_aegis_checker,
+    ".kdbx" : make_pykeepass_checker,
+    ".kdb" : make_pykeepass_checker,
 }
 
 
@@ -430,6 +448,7 @@ add_checker_factory_arg("--7zip-persistent", make_persistent_7zip_checker)
 add_checker_factory_arg("--shell", make_subprocess_checker)
 add_checker_factory_arg("--py7zr", make_py7zr_checker)
 add_checker_factory_arg("--aegis", make_py_avdu_aegis_checker)
+add_checker_factory_arg("--keypassxc", make_pykeepass_checker)
 add_checker_factory_arg(
     "--pipe",
     make_password_candidate_piper,

fiddlesticks-0.2.0/tests/checker_tests.py

@@ -0,0 +1,29 @@
+import subprocess
+
+import pytest
+
+from fiddlesticks import make_py_avdu_aegis_checker, make_pykeepass_checker
+
+from .helpers import IS_WINDOWS, KDBX_TEST_VAULT, avdu_test_vault
+
+
+@pytest.mark.skipif(IS_WINDOWS, reason="I haven't figured out the 7zip CLI on Windows yet")
+def test_is_7zip_installed():
+    args = ["7z", "--help"]
+    subprocess.check_call(args)
+
+
+def test_aegis_checker_against_avdu_vault(avdu_test_vault):
+    checker = make_py_avdu_aegis_checker(avdu_test_vault)
+    # """
+    # # Run using the encrypted test file. (Enter password "test" when prompted.)
+    # go run ./cmd/avdu -p test/data/aegis_encrypted.json -e
+    # https://github.com/Sammy-T/avdu/blob/master/README.md
+    # """
+    assert checker("test")
+    assert not checker("wrong_password")
+
+def test_pykeepass_checker_against_Test_vault():
+    checker = make_pykeepass_checker(KDBX_TEST_VAULT)
+    assert checker("test")
+    assert not checker("wrong_password")

{fiddlesticks-0.1.0 → fiddlesticks-0.2.0}/tests/end_to_end_tests.py

@@ -13,10 +13,10 @@ import fiddlesticks
 
 from .helpers import (
     IS_WINDOWS,
+    avdu_test_vault,
     _assert_candidate_within_M_of_pwd,
     _assert_files_same,
     _create_password_protected_7z_archive,
-    avdu_test_vault,
     file_names_and_contents,
     guesses_and_num_subs_from_password,
     passwords_guesses_and_num_subs,

{fiddlesticks-0.1.0 → fiddlesticks-0.2.0}/tests/helpers.py

@@ -19,6 +19,7 @@ import fiddlesticks
 
 IS_WINDOWS = sys.platform == "win32"
 BI_MAP = fiddlesticks.SHIFT_AND_LEET_BI_MAP
+KDBX_TEST_VAULT = Path(__file__).parent / "Test_vault_Do_Not_Use.kdbx"
 
 file_names = text(
     alphabet=string.ascii_letters + string.digits,

fiddlesticks-0.1.0/.gitattributes

@@ -1 +0,0 @@
-* text eol=lf

fiddlesticks-0.1.0/tests/checker_tests.py

@@ -1,22 +0,0 @@
-import subprocess
-
-import pytest
-
-from .helpers import (
-    avdu_test_vault,
-    IS_WINDOWS,
-)
-
-from fiddlesticks import make_py_avdu_aegis_checker
-
-
-@pytest.mark.skipif(IS_WINDOWS, reason="I haven't figured out the 7zip CLI on Windows yet")
-def test_is_7zip_installed():
-    args = ["7z", "--help"]
-    subprocess.check_call(args)
-
-
-def test_aegis_checker_against_avdu_vault(avdu_test_vault):
-    checker = make_py_avdu_aegis_checker(avdu_test_vault)
-    assert checker("test")
-    assert not checker("not_test")