0

Say I want to crack the password of a specific database account, beforehand I know the length of the password and amount of letters in relation to digits, for example LLLLDD (6 in length containing 4 letters and 2 digits). My best option would be if I can generate a list containing as many passwords following my requested specification/customization as possible that I can then insert as payload. How do I proceed? John The Ripper?

Improve this question
3
  • Have you looked at John? There are many password-cracking programs. The answer is: use a password cracker. I'm really not sure what you're asking.
    – schroeder ♦
    Feb 1 at 16:29
  • I have never used John the Ripper in my life. But, with a little googling I'd wager to say you're looking for Incremental mode. Set your character set and set MinLen and MaxLen. Can't immediately find a way to restrict john to only 2 digits but maybe these words can help your google efforts.
    – foreverska
    Feb 1 at 16:32
  • Welcome to the community. There is dictionary generation software like crunch, is that what you're looking for, OP?
    – Sir Muffington
    Feb 1 at 19:05

1 Answer 1

Reset to default
0

If you have the password hash and know the format as you indicated (4 letters followed by 2 digits), you can certainly use John the Ripper (JtR) to get the job done. You can also use hashcat.

You would use a custom mask like so: ?l?l?l?l?d?d

If you need uppercase, you could use hashcat and specify a custom charset too: -1 ?u?l '?1?1?1?1?d?d'

Assuming MD5 hashes, below are the commands I used to test.

## Generate test MD5 hash to crack with 4 lowercase letters and 2 digits:
echo -n "canu43" | md5sum | awk '{print $1}' > to_crack.hash

## With Hashcat:
hashcat -m 0 -a 3 to_crack.hash ?l?l?l?l?d?d

## With JtR:
john to_crack.hash --format=Raw-MD5 --mask='?l?l?l?l?d?d'

On modern hardware, that hash should be "relatively" quick to crack either way (output of hashcat below):

Cracking with lowercase

# hashcat -m 0 -a 3 to_crack.hash ?l?l?l?l?d?d
<- snip ->
Host memory required for this attack: 66 MB

1beb77a9f676c7c87cddda82b2ca4d6d:canu43

Session..........: hashcat
Status...........: Cracked
Hash.Name........: MD5
Hash.Target......: 1beb77a9f676c7c87cddda82b2ca4d6d
Time.Started.....: Thu Feb  2 10:22:03 2023, (0 secs)
Time.Estimated...: Thu Feb  2 10:22:03 2023, (0 secs)
Guess.Mask.......: ?l?l?l?l?d?d [6]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 60091.2 kH/s (10.77ms) @ Accel:512 Loops:169 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests
Progress.........: 22843392/45697600 (49.99%)
Rejected.........: 0/22843392 (0.00%)
Restore.Point....: 32768/67600 (48.47%)
Restore.Sub.#1...: Salt:0 Amplifier:0-169 Iteration:0-169
Candidates.#1....: saty70 -> hmfn43

Started: Thu Feb  2 10:21:22 2023
Stopped: Thu Feb  2 10:22:05 2023

Cracking with lower or uppercase option

# hashcat -m 0 -a 3 to_crack.hash -1 ?u?l '?1?1?1?1?d?d' --force
<- snip ->
Host memory required for this attack: 66 MB

a96d851c5e2a6ac74da0d6a192ace9a5:Canu90
1beb77a9f676c7c87cddda82b2ca4d6d:canu43

Session..........: hashcat
Status...........: Cracked
Hash.Name........: MD5
Hash.Target......: to_crack.hash
Time.Started.....: Thu Feb  2 10:31:48 2023, (6 secs)
Time.Estimated...: Thu Feb  2 10:31:54 2023, (0 secs)
Guess.Mask.......: ?1?1?1?1?d?d [6]
Guess.Charset....: -1 ?u?l, -2 Undefined, -3 Undefined, -4 Undefined
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 63497.8 kH/s (7.62ms) @ Accel:256 Loops:256 Thr:1 Vec:8
Recovered........: 2/2 (100.00%) Digests
Progress.........: 388169728/731161600 (53.09%)
Rejected.........: 0/388169728 (0.00%)
Restore.Point....: 143360/270400 (53.02%)
Restore.Sub.#1...: Salt:0 Amplifier:0-256 Iteration:0-256
Candidates.#1....: saZZ36 -> YUvH36

Started: Thu Feb  2 10:31:46 2023
Stopped: Thu Feb  2 10:31:56 2023
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .