1

I'm wondering on how to run hashcat against wpa2 passwords that are in the following format:

common dictionary word . three digits . common dictionary word

Password Example:

falcon.824.watchman

Is this possible?

  • You've seen the documentation? hashcat.net/wiki/doku.php?id=mask_attack – schroeder Jan 26 at 16:41
  • I've read that, but I dont don't understand it. Sorry. What I'm looking for is the command that would be entered if the password is, for example, falcon.824.watchman. Seeing an example would help me figure out the rest. Thanks again. – BlackDarwin Jan 26 at 17:16
1

As far as I know, plain hashcat does not allow you to do that (there is a workaround though, see below). The closest thing would be a Combinator attack:

hashcat64 -m X -a 1 hash dict.txt dict.txt 

This will combine all words from the two dictionaries (here, the same dictionary is used for both sides). This is nice, but the dots and numbers in between are still missing. They can be added with --rule-left and --rule-right, so if you, for example, knew the number in between was 824, you could do this:

hashcat64 -m X -a 1 --rule-left='$. $8 $2 $4 $.' hash dict.txt dict.txt 

However, there is no way to pass entire rulesets, which is what you would need to try all possible combinations of three digits.

Solution

Luckily, though, you're not the only person to face this problem, so a solution has been developed: comboleetor

Comboleetor allows you to combine wordlists, numbers, and punctuation in a very flexible way to generate large wordlists that you can then either store on disk or pipe to hashcat in dictionary mode (-a 0). Comboleetor options are defined by passing in a specific string via stdin, as well as in two specific files (blocks.txt and numbers.txt).

Comboleetor example (comments in files omitted):

test@test:~/comboleetor$ cat blocks.txt
falcon
watchman

test@test:~/comboleetor$ cat numbers.txt
%03d
840-849

test@test:~/comboleetor$ echo 'BNB' | perl comboleetor.pl
watchman
watchman840
watchman840watchman
watchman840falcon
watchman841
watchman841watchman
watchman841falcon
watchman842
...

This example shows how to generate password candidates based on specific patterns of words and numbers (here, the numbers are formatted to be printed as 3 characters, zero-filled, and the wordlist only consists of falcon and watchman). Now we only need to add the dots in between - unfortunately, there is no way to specify the punctuation characters used by Comboleetor in the same way as one can specifiy the blocks and numbers. Comboleetor will use a wide variety of special characters that are defined in the code itself (comboleeter.pl):

my %punct = (
#  '00sp'  => ' ',
#  '01ex'  => '!',
#  '02dq'  => '"',
#  '03ha'  => '#',
#  '04do'  => '$',
#  '05pc'  => '%',
#  '06am'  => '&',
#  '07sq'  => '\'',
#  '08lp'  => '(',
#  '09rp'  => ')',
#  '10fu'  => '*',
#  '11pl'  => '+',
#  '12cm'  => ',',
#  '13da'  => '-',
  '14pd'  => '.',
#  '15fs'  => '/',
#  '16co'  => ':',
#  '17sc'  => ';',
#  '19la'  => '<',
#  '19eq'  => '=',
#  '20ra'  => '>',
#  '21qu'  => '?',
#  '22at'  => '@',
#  '23rb'  => '[',
#  '24bs'  => '\\',
#  '25lb'  => ']',
#  '26ca'  => '^',
#  '27un'  => '_',
#  '28bt'  => '`',
#  '29lc'  => '{',
#  '30pi'  => '|',
#  '31rc'  => '}',
#  '32ti'  => '~',
  );

The snipped above shows how to comment all punctuation characters except the dot in order to limit our wordlist size as much as possible. After doing this, we can generate our example wordlist by specifying a combination of blocks, punctuation, numbers, punctuation, and blocks:

test@test:~/comboleetor$ echo 'BPNPB' | perl comboleetor.pl     
falcon
falcon.
falcon.840
falcon.840.
falcon.840.falcon
falcon.840.watchman
falcon.841
falcon.841.
falcon.841.falcon
falcon.841.watchman
falcon.842
falcon.842.
falcon.842.falcon
falcon.842.watchman
falcon.843
falcon.843.
falcon.843.falcon
falcon.843.watchman
falcon.844
falcon.844.
falcon.844.falcon
falcon.844.watchman
falcon.845
falcon.845.
falcon.845.falcon
falcon.845.watchman
falcon.846
falcon.846.
falcon.846.falcon
falcon.846.watchman
falcon.847
falcon.847.
falcon.847.falcon
falcon.847.watchman
falcon.848
falcon.848.
falcon.848.falcon
falcon.848.watchman
falcon.849
falcon.849.
falcon.849.falcon
falcon.849.watchman
watchman
watchman.
watchman.840
watchman.840.
watchman.840.falcon
watchman.840.watchman
watchman.841
watchman.841.
watchman.841.falcon
watchman.841.watchman
watchman.842
watchman.842.
watchman.842.falcon
watchman.842.watchman
watchman.843
watchman.843.
watchman.843.falcon
watchman.843.watchman
watchman.844
watchman.844.
watchman.844.falcon
watchman.844.watchman
watchman.845
watchman.845.
watchman.845.falcon
watchman.845.watchman
watchman.846
watchman.846.
watchman.846.falcon
watchman.846.watchman
watchman.847
watchman.847.
watchman.847.falcon
watchman.847.watchman
watchman.848
watchman.848.
watchman.848.falcon
watchman.848.watchman
watchman.849
watchman.849.
watchman.849.falcon
watchman.849.watchman

This wordlist can then be stored on disk or redirected to hashcat. Obviously, when using a real dicitionary and all numbers up to 999, this wordlist will easily become huge, so piping is probably the better idea. Additionally, as you can see, this will generate quite a number of candidates not exactly matching your pattern (e.g., candidates like watchman.849.), but this is the closest I could get to your requirements.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.