5

I want to crack a password which pattern was 10 digits start with 0910 or 0912. So possible passwords would be e.g.

0910333444, 0910444566, 0912111222, 0912145632.

How to configure the incremental mode in John the Ripper to try all possible passwords of this pattern?

Note: I want to pipe the password with aircrack-ng to crack a WAP PSK, so I can only use John the Ripper.

2

Here's how to do it with john (the "jumbo" version), using head to just show the first ten lines of output:

$ john -1='02' -mask=091?1?d?d?d?d?d?d --stdout | head
Press 'q' or Ctrl-C to abort, almost any other key for status
0910111111
0912111111
0910011111
0912011111
0910211111
0912211111
0910311111
0912311111
0910911111

And for what it's worth, you can also pipe hashcat output to another tool, using hashcat's --stdout option, following @dandavis' suggestion:

$ hashcat -a 3 -1 02 091?1?d?d?d?d?d?d --stdout | head
0912199999
0912231234
0912567899
0912000000
0912900000
0912888899
0912300000
0912452345
0912777899
0912699999

In both cases above, we're defining a custom character set "1", containing the two characters '0' and '2', and then using it in the mask with ?1.

But you don't really want to do either of these. There's no need to pipe a wordlist to anything, because starting with hashcat 4.0.0, you can skip aircrack-ng entirely, and directly crack a WPA2 PSK with hashcat (using -m 2500):

$ hashcat --quiet -a 3 -m 2500 hashcat.hccapx hash?l?l?l?s
a895f7d62ccc3e892fa9e9f9146232c1:aef50f22801c: (wrapped)
    987bdcf9f950:8381533406003807685881523:hashcat!

So your command would probably look something like:

$ hashcat -a 3 -m 2500 -1 '02' hashcat.hccapx 091?1?d?d?d?d?d?d

For fast hashes, this is the most efficient method, as the candidate passwords will be generated much faster on GPU. For a slow hash like WPA2, it doesn't make much of a difference in efficiency.

For more information, see this reference, as well as the closely related hcxtools project, which you may need in order to convert your captured PSK into the hccapx format required by hashcat.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.