Brute force MD5 with a prefix and suffix up to n characters/words

Question

I have a couple of things I would like to explore with hashcat. I have a MD5 hashed password, which I know for a fact has a prefix and a suffix. The actual password is located in the middle of the prefix and the suffix, and that password may contain the following characters:

• Uppercase characters
• Lowercase characters
• Underscore (_)

I have already figured out how to do this attack with the prefix and suffix:

hashcat [HASH] -a 3 PREFIX_?l?l?l?l?l_SUFFIX

That will try a 5 character password, which only includes lowercase characters because of ?l. My first question is therefore: How do I generate a charset that includes [A-Za-z] and underscore, then start an attack on a hash starting from 1 character to 10 characters? It basically needs to run through each combination from 1 character to 10 characters.

---

Alternatively, is it possible to start a dictionary attack instead of using a charset, but separate each word with an underscore? Also up to maybe 10 words. Example:

words.txt

telephone
bottle
door
toilet

The password I need to crack would then go something like PREFIX_telephone_bottle_SUFFIX, PREFIX_bottle_toilet_door_telephone_SUFFIX, separating the words with an underscore.

Answer 1

Hashcat lets you load a list of masks from a file - one mask per line.

[Edited to expand my previous too-brief answer above]:

Hashcat also lets you specify up to 4 custom character sets using the -1, -2, -3, and -4 parameters. Your specific custom character set (upper, lower, underscore) could be specified like so (I'm using "2" to make it obvious that it's not a lower-case L, but it could be 1, 2, 3, or 4):

-2 ?l?u_

You would then invoke hashcat something like this:

$ hashcat -a 3 [other options] -2 ?l?u_ [hashfile] [maskfile]

... with the mask file containing something like the following, with one line for each password length that you're expecting:

PREFIX_?2_SUFFIX
PREFIX_?2?2_SUFFIX
PREFIX_?2?2?2_SUFFIX
PREFIX_?2?2?2?2_SUFFIX
PREFIX_?2?2?2?2?2_SUFFIX
PREFIX_?2?2?2?2?2?2_SUFFIX
PREFIX_?2?2?2?2?2?2?2_SUFFIX
PREFIX_?2?2?2?2?2?2?2?2_SUFFIX
PREFIX_?2?2?2?2?2?2?2?2?2_SUFFIX
PREFIX_?2?2?2?2?2?2?2?2?2?2_SUFFIX

This lets you run the entire attack by only calling hashcat once.

Instead of specifying the custom character set on the command line, you can also specify them positionally in the maskfile itself, separated by commas:

?l?u_,PREFIX_?2_SUFFIX
?l?u_,PREFIX_?2?2_SUFFIX
?l?u_,PREFIX_?2?2?2_SUFFIX
?l?u_,PREFIX_?2?2?2?2_SUFFIX
?l?u_,PREFIX_?2?2?2?2?2_SUFFIX
?l?u_,PREFIX_?2?2?2?2?2?2_SUFFIX

... etc. This is sometimes preferable because it stores the custom character set directly in the mask file, instead of ephemerally on the command line - so that more of your attack strategy is persistently documented. (This can also let you specify different custom character sets on each line for each mask - which isn't necessary for your question, but can be very handy for other kinds of attacks.)