2

I came across a test question that said "Given a random password, which type of mode typically produces fastest results?" and the two likely answers were "brute force" and "incremental". The instructions were to circle all of the possibilities (so not you're typical multiple choice). First off, I think the question is poorly worded: does it mean random password as in any password you know nothing about or random password as in you know that a random password generator was used to produce it? This makes a difference as a user generated password probably has words in it that may be in a wordlist.

Is my reasoning correct, a wordlist is only useful if there's words in the password, and wastes time if there's not? Can an attacker know in advanced whether or not there's word in a password they're trying to crack?

I know in John the Ripper there's word mangling rules, what is this?

By the way, are the terms "dictionary" and "wordlist" usually used interchangeably in this context?

  • What were the other choices? This may help answerers in explaining the intention of the question. – SilverlightFox Oct 27 '15 at 8:56
1

The question is poorly worded but it's safe to assume they're talking about human generated passwords.

Is my reasoning correct, a wordlist is only useful if there's words in the password, and wastes time if there's not?

Using a wordlist can be successful on random passwords, although incremental cracking will usually be more performant.

I know in John the Ripper there's word mangling rules, what is this?

In my understanding, this refers to leetspeaking words (e.g 'f00tball' instead of 'football'.)

By the way, are the terms "dictionary" and "wordlist" usually used interchangeably in this context?

Yes.

1

Just to expand on the previous answer.

Is my reasoning correct, a wordlist is only useful if there's words in the password, and wastes time if there's not?

It's not necessary for the password in question to contain words. It depends on the wordlist itself. A good wordlist can save you a lot of time. Some popular wordlists not only contain words that one would find in a dictionary, but also a few mangled words (I'll get to this in a bit). Programs like john and crunch can help you create a custom wordlist for your target. But yes, It is highly unlikely to find a randomly generated password in a wordlist and atleast some part of the password should contain words to improve your chances of a wordlist based attack.

I know in John the Ripper there's word mangling rules, what is this?

Now, this is an interesting topic. Word Mangling (in case of johntheripper) is in simple terms mutating all the words in a wordlist according to rules defined in /etc/john/john.conf (on a linux machine). I'll explain this better by example. Users most commonly tend to mutate their passwords in various ways. This could include adding a few numbers at the end of the password, swapping out lowercase for capital letters, changing certain letters to numbers, etc. So lets assume that you know a particular person (or victim in our case) likes to append two numbers at the end of his/her passwords (which in most cases is a word to remember it better). You can add a rule in johntheripper's configuration file.

$[0-9]$[0-9]

And after that you create a mutated wordlist with the following command.

john --rules --wordlist=/path/to/wordlist --stdout > new_word_list

This will create a new wordlist (using the rules in the config file) which is a mangled version of the old wordlist, which will better your chances of a successful wordlist attack. Similarly you can append stuff (characters, numerals, special characters), change characters to upper/lower case, change specific indices to a character of your choice, etc just by adding the relevant rules to the config file. I'm not sure how to explain this better, but i hope you got the gist of it.

By the way, are the terms "dictionary" and "wordlist" usually used interchangeably in this context?

Yes, in this context "dictionary" and "wordlist" are interchangeable terms. This is because when the attack first came out, hackers were literally using words from the dictionary as a wordlist (people back then didn't use strong passwords). As people became aware of the "dictionary-attack", they started mangling their passwords (eg, horses1234, alabama12, etc). So the hackers developed their methods and came out with a mangled version of the dictionary. And (over the years) after all that mangling, adding slang, etc the resulting wordlist looked nothing like a dictionary and hence hackers started referring to it as a wordlist.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.