I would like to generate a wordlist that contains words and 2 digit numbers. I want crunch to shuffle them like 15password15, password15, 15password...
Is there any way I can do that with crunch or do I need another script?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Depending on your use case, there are a couple of options:
If you want a lot of control over the contents, but you also want many permutations, then scripting it yourself (as already suggested in the comments) may be the only way to do it.
Otherwise, tools from the hashcat family can be used to generate all possible permutations up to a given element count. Especially for the general use case from the title of your question "using words like chars", princeprocessor is an effective choice.
At a minimum, it sounds like you'll need to use a script to generate all possible two-digit numbers, and then combine that list with your other dictionary, and then feed them into a tool that will generate many different combinations for you. There are a couple of ways to do this.
Here are the files that I'll use in some examples.
$ cat - >words.list password qwerty iloveyou $ seq -w 1 99 >digits.list $ head -1 digits.list 01 $ tail -1 digits.list 99
Combining a list of strings into all possible combinations is what password crackers usually called a combinator attack. Some variants of this attack only combine each element twice, or three times, but it sounds like you're looking for a range of element counts. Otherwise, combinator and combinator3 from hashcat-utils could generate the lists:
$ combinator words.list digits.list | head -5 password01 password02 password03 password04 password05 $ combinator3 digits.list words.list digits.list | head -5 01password01 01password02 01password03 01password04 01password05
If you only needed to iterate through all possible numbers in a specific position (at the end or at the beginning), a hybrid attack (wordlist + mask) would work, and you could use hashcat's
--stdout option to generate the list:
$ hashcat --stdout -a 6 words.list ?d?d | head -5 password12 password08 password20 password31 password98 $ hashcat --stdout -a 7 ?d?d words.list | head -5 12password 08password 20password 31password 98password
But if you want more than 3 elements per result -- strings like '1515password15', 'passwordpassword1515', '15password15password' -- etc, then you'll run into the two- or three-element-per-string limits of these approaches.
If you are willing to be a little relaxed about composition - in other words, if it's OK if some of the strings are digits-only sequences like "013522" or words with no digits at all, you can escape those limitations with princeprocessor (
pp64), like so:
$ cat words.list | pp64 | tail -5 iloveyouquerty passwordpassword iloveyoupassword passwordiloveyou iloveyouiloveyou
princeprocessor will generate all possible permutations, up to the element count that you specify.
One potential issue is that princeprocessor will try to order the output in favor of shorter strings first, so you'll get a lot of numbers before you start to hit the words:
$ cat digits.list words.list | pp64 | head -100000000 | tail -5 07743573 08743573 09743573 10743573 11743573
If you want more control over the contents - for example, all of the resulting strings must contain at least one set of non-digits, I'd simply filter the results with
$ cat digits.list words.list | pp64 | egrep [a-z] | head password iloveyou 01qwerty 02qwerty 03qwerty 04qwerty 05qwerty 06qwerty 07qwerty 08qwerty 09qwerty 10qwerty $ cat digits.list words.list | pp64 | egrep [a-z] | egrep [0-9] | head -5000 | tail 4145qwerty 4245qwerty 4345qwerty 4445qwerty 4545qwerty 4645qwerty 4745qwerty 4845qwerty 4945qwerty 5045qwerty
If you only want results that guarantee at least one element from both list, but you also want a variable number of elements, filtering the output from princeprocessor is the best way that I know of.
Filtering the output from princeprocessor with
grep is a bit of a workaround (for there being no tool that natively understands that you want at least one element from each list). As far as I know, if that's your use case, it would require new development (either writing your own script, or modifying the princeprocessor source).