I want to test oclHashcat on a WPA-2 PSK password of length 8 containing only characters in the set {a-z, A-Z, 0-9}.

To do this I have already captured the handshake in a .cap file and converted it to a .hccap file.

All tutorials I've found explain how to brute-force using a wordlist. But in this case, the password is random generated, has length 8, and contains only characters in the above set, so a wordlist won't be of much value?

How do I tell oclHashcat to start brute-force WPA-2 PSK using only candidate passwords of length 8 and with characters in the above set??

  • 1
    have you tried using masks? link define a charset: -1 ?d?u?l and then use it – Silverfox Jan 20 '16 at 12:42
  • Could you give me the command? How do I specify the hash originates from WPA-2 etc? – Shuzheng Jan 20 '16 at 12:56
  • Brute-forcing is the testing of every single password combination. Testing combinations from a certain character set can be done with a dictionary attack or a rules-based attack. – cremefraiche Jan 21 '16 at 5:07

Check the mask_attack page of the hashcat wiki.

For your case:

oclHashCat64.bin -m 2500 -a 3 -1 ?l?u?d ?1?1?1?1?1?1?1?1 [YOUR HASH OR HASH FILE]
  • "-m 2500" specifies the WPA/WPA2 hash type, per hashcat documentation
  • "-a 3" is the brute force attack mode
  • "-1 ?l?u?d" says to use the character set of lowercase, uppercase, and digits (the character set you desire in your question)
  • "?1?1?1?1?1?1?1?1" looks for precisely 8 characters using your character set

Note that I don't have access to my hash cracking box at the moment to test this. Run oclHashCat64.bin without parameters to see the help options.

Additionally, replace the binary name with the version you're using - cudaHashCat.bin for NVidia, omit the "64" if you're using the 32-bit version, etc.

  • Thank you, very much. I figured it out myself late yesterday, but I'm glad I did it right. Can it be true, that it takes > 10 years to brute-force such a password using NVIDIA GTX 970? – Shuzheng Jan 21 '16 at 9:44
  • That card has been benchmarked for cudaHashcat at 173 kH/s. If your password is exactly 8 characters using only numbers (10), lowercase (26) & uppercase letters (26), then the possible brute-force possibilities are (10+26+26) ^ 8 = 2.2 x 10^14. Divide by 1.73 x 10^5 (card's cracking speed) gives you 1.27 x 10^9 seconds = 40 years. Statistically, you will average half that (20 years). Brute force is not best force. – armani Jan 21 '16 at 17:55
  • What exactly does "kH" stand for? I guess "kilo hash", but kilo is normally 10^3? So basically what you can conclude is, that if the password is "purely" random generated, then it is 100% secure against brute-force, unless you have a super computer? What attack would be effective in order to lure an 8-digit WPA-2 PSK password? Some kind of social engineering attack, or maybe some network based attack? – Shuzheng Jan 22 '16 at 12:03
  • Yes, kH = 1,000 hashes, so 173 kH = 173,000 = 1.73 x 10^5. – armani Jan 22 '16 at 17:09
  • 1
    A purely random generated passphrase at 8 digits could be cracked by a cluster of nodes each containing multiple GTX Titan X or GTX 980 Ti cards. The power gain is linear, so the more hardware correlates directly with reduction in time to crack. Crooks can also rent out GPGPU space in Amazon's AWS cloud for this purpose, so an 8-digit passphrase can be compromised as quickly as someone puts up the money for the hardware (renting or owning). Nothing is 100% secure. – armani Jan 22 '16 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.