1

I am trying to make a combinator attack using just one dictionary:

word1
word2
word3
word4
word5
...

And would like to try all 4-words-length permutations separated by commas:

word1,word2,word3,word4
word1,word3,word4,word2
word2,word3,word6,word1
...

1 Answer 1

1

The 'princeprocessor' tool from hashcat-utils can get you most of the way there, but the separators make this a little tricky. You can also just do it with a shell script.

The best method I know of right now is 'combinatorX', which is matrix's enhancement of combinator from hashcat-utils that also understands custom separators. But it's only in source-code form right now - you'd need to download it and compile it yourself.

https://github.com/hashcat/hashcat-utils/pull/58

Usage: combinatorX [<options>]

Options:

  Argument   | Type        | Description                           | Option type | Example
  ----------------------------------------------------------------------------------------------
  --file1    | Path        | Set file1 path                        | required    | --file1 wordlist1.txt
  --file2    | Path        | Set file2 path                        | required    | --file2 wordlist2.txt
  --file3    | Path        | Set file3 path                        | optional    | --file3 wordlist3.txt
  --file4    | Path        | Set file4 path                        | optional    | --file4 wordlist4.txt

  --sepStart | Char/String | Set char/string at the beginning      | optional    | --sepStart '['
  --sep1     | Char/String | Set separator between file1 and file2 | optional    | --sep1 'a.'
  --sep2     | Char/String | Set separator between file2 and file3 | optional    | --sep2 'bc'
  --sep3     | Char/String | Set separator between file3 and file4 | optional    | --sep3 ',d'
  --sepEnd   | Char/String | Set char/string at the end            | optional    | --sepEnd ']'

  --skip     | Num         | Skip N segments                       | optional    | --skip 0
  --limit    | Num         | Exit after N segments                 | optional    | --limit 1

  --session  | String      | Set session name                      | optional    | --session testSession
  --restore  | String      | Restore by session name               | optional    | --restore testSession


Example:

input files: 1 2 3 4
$ cat 1 2 3 4 | xargs
one two three four
$ ./combinatorX.bin --file1 1 --file2 2 --file3 3 --file4 4 --sep1 ' . ' --sep2 ' + ' --sep3 ' @ ' --sepStart "['" --sepEnd ',*]'
['one . two + three @ four,*]

... and then just repeat your wordlist and separators for arguments:

$ combinatorX --file1 test.list --file2 test.list --file3 test.list --file4 test.list --sep1 ',' --sep2 ','  --sep3 ','
word1,word1,word1,word1
word1,word1,word1,word2
word1,word1,word1,word3
word1,word1,word1,word4
word1,word1,word1,word5
word1,word1,word2,word1
word1,word1,word2,word2
word1,word1,word2,word3
word1,word1,word2,word4
word1,word1,word2,word5
[...]

If you're working with a slow hash, just pipe the output to hashcat. If you're working with a fast hash, your GPUs might bottleneck unless you do something like create a rule to append all your fourth words (which should work fine unless your wordlist is more than a million elements long, etc). Since the rules are applied on GPU, this can speed up performance considerably for fast hashes:

$ cat append-fourth-word.rule
$, $w $o $r $d $1
$, $w $o $r $d $2
$, $w $o $r $d $3
$, $w $o $r $d $4
$, $w $o $r $d $5
[...]
2
  • Thank you, I just learned about hashcat and wrote a python script that pipes a list of ~11 billion permutations to hashcat. The script uses itertools.permutations() but it takes forever to complete. What approaches would you suggest to run it in parallel?
    – XY6
    Commented Feb 21, 2021 at 4:35
  • 1
    It will bottleneck for fast hashes unless you add the fourth word on GPU - see above Commented Feb 21, 2021 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .