I was wondering what could be a way of generating a list where the passwords were like:

``````CorrectHorseBatteryStaple
BanjoTurtleNinjaHobo
PizzaSurfMotherMetal
etc...
``````

I already fiddled a little with crunch but i couldn't find a way of selecting groups of words to permutate. I thought of writing a script that run in a wordlist of english words (not counting articles and such ) and grabs 3-5 words at random and then toss them into cruch for the permutations, but i soon realized that the resulting worldlist would quicly reach a dimension beyond useful.

Maybe there is a way to just generate a fraction of the permutations for each set of words, the list wouldn't be complete but at least it could be usable.

lets say, picking 4 words at random from the first 2000 most used words ( not considering articles and such ) and permutate on those 4 words (or 3 or 5).

Running some numbers:

``````combinations of 4 words out of a group of 2000: 664,668,499,500 ( 664 Bilions ).
permutations of 4 words: 4! = 24

24 * 664,668,499,500 = 15,952,043,988,00 ( 15,952 Bilions ).
``````

And that would mean something like a little over 30 PB of wordlist. (i assumed 7 bytes for each word ). Too much.

Even taking half of those combinations would mean having 15 PB of material to scan through.

Those are 50 years of non stop password cracking at a whoping 10000 words/s. No thank you.

Is there a more clever idea? I'm beginning to think that this kind of passwords are almost uncrackable.

• What exactly are you trying to accomplish? Are you trying to generate a list of candidate passphrases for cracking or online guessing? What are you looking for Crunch to do for you? Do you just want to capitalize the first letter of words from a word list and combine them in 3-5 word sequences? Are you trying to generate all the lowercase/uppercase letter combinations of these words? Do you want crunch to generate more permutations than just different capitalizations? It's possible you're better off using rules within your cracking software to create these candidates for you on the fly. May 18, 2016 at 16:49
• The original idea was creating different sets of wordlists, for example one with just combination of variable lenght of numbers and lowercase letters (gibberish), another maybe same thing with upper case letters, etc. but those are easily done simply iterating on the same simple english words dictionary. having lower or uppercase first letters doesn't really matter, that could be changed rather easily. What i'm asking is if there's a way of generating such list in a way that is usable (size wise) or generating it on the fly. May 18, 2016 at 17:06
• "I'm beginning to think that this kind of passwords are almost uncrackable" << that's kind of the point.
– Ben
Jan 15, 2018 at 17:19

You're 100% right that storing all possible permutations wouldn't scale very well.

An efficient way to generate all possible passphrases from a source wordlist "on the fly" (without having to store the result) is by using the hashcat project's princeprocessor:

``````\$ cat wordlist.txt
Correct
Horse
Battery
Staple

\$ pp64 --elem-cnt-min=4 <wordlist.txt | head
HorseHorseHorseHorse
HorseHorseHorseStaple
HorseHorseStapleHorse
HorseStapleHorseHorse
StapleHorseHorseHorse
HorseHorseStapleStaple
HorseStapleHorseStaple
StapleHorseHorseStaple
HorseStapleStapleHorse
StapleHorseStapleHorse
``````

By default, the maximum password length that will be generated is 16 characters. For your use case, you'll probably want to bump that up (so that the above will work):

``````--- pp.c    2018-01-06 14:55:52.259441280 -0900
+++ pp.c.new    2018-01-14 18:20:51.162651928 -0900
@@ -29,7 +29,7 @@
#define IN_LEN_MAX    32
#define OUT_LEN_MAX   32 /* Limited by (u32)(1 << pw_len - 1) */
#define PW_MIN        1
-#define PW_MAX        16
+#define PW_MAX        32
#define ELEM_CNT_MIN  1
#define ELEM_CNT_MAX  8
#define WL_DIST_LEN   0
``````

... and recompile:

``````\$ make clean
rm -f pp32.bin pp64.bin pp32.exe pp64.exe pp32.app pp64.app

\$ make
gcc   -W -Wall -std=c99 -O2 -s -m64 -DLINUX   -o pp64.bin pp.c mpz_int128.h

\$ ls -la pp64.bin
-rwxr-xr-x 1 user user 22912 Jan 14 18:27 pp64.bin
``````

A killer feature of princeprocessor is its ability to pick up where it left off using the `-s` flag, if you have to interrupt the process for some reason. It stores a restore value in the "pp.save" file upon exit, and that value can be used to resume exactly where it was interrupted, even billions of guesses in. This makes its value over a large static wordlist even better.

• Finally something, even though it was merely a question out of curiosity i looked for an answer for days without finding anything, i even tried writing a script myself with not so great results. Now, more than a year later, i get a perfect answer, Thank you so much! Jan 16, 2018 at 10:41