I'm using cudahashcat to bruteforce my sky router with 8 character all uppercase password, with keys tested at around 4200k/s. When using cudahashcat with a dictionary i created with crunch, i'm still getting the same amount of keys tested per second. I'm asking this as i saw somewhere before stating you can test 100% more keys per second read from a wordlist, but i can no longer find this post.

Any help would be much appreciated.


Using a dictionary isn't going to increase your rate of attempted cracking, as the program still has to take the input, apply whatever hashing algorithm is required, and then compare with the password to be cracked.

The use of a dictionary is that if the password is the same as one in the dictionary (or similar if you're using mangling rules), you'll find it a lot faster.

Even large dictionaries are very small compared to attempting to guess every single possible password.

  • So the only way i'd increase k/s is more gpu power :/ oh well worth an ask....Thanks May 25 '17 at 23:53
  • I did try some gpu accel + gpu loops with not much of an increase....i'll be honest in saying my gpu is not great...GeForce GT 520. May 26 '17 at 0:15

I suspect what you read was implying using a dictionary first would find the 'low hanging fruit' passwords quicker.

  • This was most likely the case, although what i remember seeing was 100,000 k/s...starting to think it may have been a super computer idk...Thanks May 25 '17 at 23:57

You can use pre-computed password hashes called Rainbow Tables to increase your rate, but in fact it only worth the effort of genereation if you are using the same set more than once. Despite of that, it may worth checking :)

  • Thank you for the information...I've not tried that yet..I will check it out :) Jun 5 '17 at 22:47

Dictionaries are not like Websters. They include several categories such as default passwords (admin), most-used passwords (abc123), and such. Plus, attackers will also use proper names and common words, with numerical substitutions for letters (G00gl3). And if they are really after your use of a particular website (like a bank) they will try to change a password there to learn the parameters of that site (like passwords must be 15 characters long, or that they must start with a capital letter, or that they must start with a numeral, or include symbols).

This is called reducing the search space.
And yes, it results in more possibly-valid keys being searched per unit time as opposed to using raw brute-force)

Then they will do things like call tech support and provide answers to the secret questions (what high school did you go to, mother's maiden name) or anything they know (and for public figures a lot of that gets published). This is how Kevin Mitnick did most of his cracking.

Brute-forcing will always work, given enough time, but generally there is no need for it.

So even though your processor will not actually search any faster, it will definitely search faster through relevant possibilities with the use of dictionaries.

  • Some interesting information :) thank you......my dictionary/wordlist was 8 uppercase only as most sky passwords are only that...this is why i compared using bruteforce and my own crunch created 8 uppercase wordlist....I see how using social engineering would help a lot if i were to be targeting a human password.....but in my case i wanted more k/s......Thanks again. May 26 '17 at 0:07
  • In regards to my processor searching faster through relevant possibilities of a dictionary...would this mean i should have seen an increase in k/s ? May 26 '17 at 0:11

The speed of keys/s can only be modified either by more power (more CPU or even better using GPU) or pre-compute.

You can pre-compute the keys, it's called memory-time trade off Pass the dictionary through the PBKDF2 to generate all the pre-computed PMK for that SSID, in which will increase your cracking speed my more than just 100%.

Tell me if you want me to elaborate... really tired right now. I think I already explained that in here a while ago, and also here

  • That pre compute you mentioned...if i were to pass my crunch made dictionary of roughly 50gb in size and usually im getting 4200k/s do you know as an estimate, how much it would increase by ? May 27 '17 at 18:31
  • Also i dont know if ive maybe computed one before and not known because i did use pyrit. May 27 '17 at 18:48
  • And lastly if you could tell me the difference between k/s and hashes a second...could that be an option for me to crack faster...hope i didnt just ask a noobie question. May 27 '17 at 18:51
  • @SupaLemonHaze TBH idk the how much faster, I just know that it's less time to crack pre-computed PMK, than just crack passphrase, becase 4096 hashes per each passphrase is a lot.
    – Azteca
    May 28 '17 at 5:34
  • And about the keys vs hashes I'm not sure what you mean, but remember to generate 1 PMK it must pass through the PBKDF2 which hashes it 4096 times (each passphrase) and this generates one PMK (key) for a given SSID. And in aircrack-ng output when you're cracking it gives the KEYS per second.
    – Azteca
    May 28 '17 at 5:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.