John has a mask too.
Mask mode is a fast way to produce password candidates given a "mask"
that describes what the words should look like.
A mask may consist of:
- Static letters.
- Ranges in
[aouei]
or [a-z]
syntax. Or both, [0-9abcdef]
is the same as [0-9a-f]
.
- Placeholders that are just a short form for ranges, like
?l
which is equivalent to [a-z]
.
?l
lower-case ASCII letters
?u
upper-case ASCII letters
?d
digits
?s
specials (all printable ASCII characters not in ?l, ?u or ?d)
?a
full 'printable' ASCII
?A
all valid characters in the current code page
?h
all 8-bit (0x80-0xff)
?H
all except the NULL character (which is currently not supported by core)
?L
non-ASCII lower-case letters
?U
non-ASCII upper-case letters
?D
non-ASCII "digits"
?S
non-ASCII "specials"
- Placeholders that are custom defined, so we can eg. define
?1
to mean [?u?l]
?1 .. ?9
user-defined place-holder 1 .. 9
- Placeholder for Hybrid Mask mode
?w
is a placeholder for the original word produced by the parent mode in
Hybrid Mask mode.
Mask Mode alone produces words from the mask, for example ?u?l?l
will
generate all possible three-letter words, with first character
uppercased and the remaining in lowercase.
Hybrid Mask means we use eg. a wordlist with or without rules (or some
other cracking mode), and then apply the mask to each word. So with a
mask of ?w?d?d
and an input word (from the parent cracking mode) of
"pass", it will produce "pass00", "pass01" and so on until "pass99".
Hybrid Mask can be stacked upon Incremental, Markov, Wordlist and
External modes.
External Filters currently can't be applied to Hybrid Mask output.
You can define custom placeholders for ?1 .. ?9
using command line eg.
-1=?l?u
or in john.conf section [Mask].
There is a default mask in john.conf too (defaulting to same as
Hashcat: ?1?2?2?2?2?2?2?3?3?3?3?d?d?d?d
). This should be used with
-max-len
and possibly
-min-len
.
The -max-len=N
option will truncate the mask so no words longer than N
are produced.
The -min-len=N
option will skip generation of words shorter than N,
and more importantly in this case, it will iterate length from
-min-len
to -max-len
(or format's max length, if -max-len
was not given). So to produce all possible words from 3 to 5 letters, use
-mask=?l?l?l?l?l -min-len=3 -max-len=5
. For this to work, the mask must have at least 5 positions defined.
You can escape special characters with \
. So to produce a literal "?l
"
you could say \?l
or ?\l
and it will not be parsed as a placeholder.
Similarly you can escape dashes or brackets to prevent them from being
parsed as specials. To produce a literal backslash, use \\
.
There is also a special hex notation, \xHH
for specifying any
character code. For example, \x41
is "A" and \x09
is the code for TAB.
Examples:
**Mask custom mask / hybrid input example output num candidates**
pass pass 1
pw%d pw3 10
?w?d?d?d password password123 1000x
?w?s?w bozo bozo#bozo 33x
0x?1?1:?1?1:?1?1 -1=[0-9a-f] 0xde:ad:ca 16777216
?3?l?l?l -3=?l?u Bozo, hobo 913952
[Pp][Aa@][Ss5][Ss5][Ww][Oo0][Rr][Dd] P@55w0rD 1296
Even you can use external program to pass the generated passwords to John:
Like this: crunch 1 6 abcdefg | ./john hashes -stdin -session=s1