MaskCracker is a comprehensive security assessment tool tailored for evaluating the safety of Metamask wallets under real-world attack scenarios. This innovative tool focuses on two critical scenarios: when website passwords saved in browsers are compromised and when malicious code inadvertently gets executed.

Key Features

MaskCracker incorporates several capabilities to ensure thorough security analysis:

• Password Export: Effortlessly exports passwords stored in Chrome browsers.
• AI-Driven Analysis: Utilizes advanced AI models to identify password patterns and constructs high-probability password dictionaries.
• Integration with Hashcat: Leverages the world-renowned Hashcat password recovery tool to crack Metamask seed phrases or private keys, maximizing the chances of recovering lost access securely.

Disclaimer: MaskCracker is designed solely for security research purposes. It is the user's responsibility to utilize this tool within legal boundaries, and the author assumes no legal liability.

Usage

To get started with MaskCracker, activate the virtual environment and run various commands to execute specific functions. Here’s an overview of some common sub-commands:

# To print all Chrome passwords
python src/main.py chrome-password

# To decrypt Metamask seed phrases using a password
python src/main.py decrypt-metamask your_password

Password Cracking Workflow

1. Generate a Dictionary Create a dictionary from available passwords, including the option to incorporate Chrome passwords:

   python src/main.py generate-dict --chrome-pass output/dictionary
   

2. Prepare Hashcat Target File Generate a formatted file for Hashcat:

   python src/main.py prepare-hashcat output/hashcat-target.txt output/dictionary
   

3. Run Hashcat Execute the cracking process using the provided scripts:

   # For macOS
   bash run_hashcat.sh
   
   # For Windows
   .\run_hashcat.bat
   

Common Password Libraries

Utilize well-known password libraries to enhance the success rate:

• RockYou - Contains approximately 32 million user passwords from the 2009 RockYou breach.
• LinkedIn Password - Includes 160 million user password hashes from the 2012 breach.
• CrackStation - A popular resource for password cracking.

The provided password libraries are sourced from public domains and meant strictly for research purposes.

Future Enhancements

MaskCracker aims to evolve further with plans to:

• Enhance the decryption of Metamask LDB files to extract seed phrases under various conditions.
• Implement nuanced rules for password generation based on existing user passwords.
• Employ AI models to craft tailored password dictionaries based on Chrome password analysis.

For detailed troubleshooting and installation guidance, please refer to the README. For additional insights into blockchain technology, visit blog-blockchain.xyz to explore engaging articles.