Hashcat Rules

Sunday, August 12, 2012 Posted by Unknown 0 comments
Link to information about Hashcat rule based attack.

Besides the out of box rules and some of the amazing rules atom and his team comes up with. I will be updating this post from time to time adding new rules I come up with or others give me the idea to come up with.

malik51: and i where talking. I was trying to get ?d?s to be preappended and appended to a pass. As running two rules one appending and one preappending is slow and doesn't work.  After much frustration I had one good idea what I will share below. His solution.

./mp64.bin -1 ?d?s '$?1 $?1 Y2 }}' -o malik51roll2.rule
./mp64.bin -1 ?d?s '$?1 $?1 $?1 Y3 }}}' -o malik51roll3.rule

This will add the same to both sides. !@pass!@ or 123pass123. Works great, and its fast.

However, I wanted more.  I wanted passwords like 1@pass$% or 123pass#$%  What I thought was the solution to the above actual works for this. It will first reverse the pass. ssap then append the digit or special character ssap@1 then reverse the word again. 1@pass  Then finally append the next set to get you 1@pass$%

./mp64.bin -1 ?d?s 'r $?1 $?1 r $?1 $?1' -o init6reverse.rule

However, this only works for two spots. you cant do 123pass#$% just to big.

In the spirit of the malik51roll2.rule I made the ldsUroll.rule
./mp64.bin -1 ?l?d?s?u '$?1 $?1 Y2 }}' -o ldsUroll.rule
It appends and presppends lowercase, digits, special, and uppercase.


EDIT: 8/12/2012 4:13AM

The following haven't found that many, but they found some.


bible verse numbers:

./mp64.bin -1 123456 -2 12 '$: $?d $?d' -o biblenum1.rule
./mp64.bin -1 123456 -2 12 '$: $1 $?d $?d' -o biblenum2.rule
./mp64.bin -1 123456 -2 12 '$  $: $?d $?d' -o biblenum1a.rule
./mp64.bin -1 123456 -2 12 '$  $: $1 $?d $?d' -o biblenum2a.rule
./mp64.bin -1 123456 -2 12 '$?d $: $?d $?d' -o biblenum3.rule
./mp64.bin -1 123456 -2 12 '$?d $: $1 $?d $?d' -o biblenum4.rule
./mp64.bin -1 123456 -2 12 '$?1 $?d $: $?d $?d $?d' -o biblenum5.rule
./mp64.bin -1 123456 -2 12 '$?1 $?d $: $1 $?d $?d $?d' -o biblenum6.rule
./mp64.bin -1 123456 -2 12 '$1 $5 $0 $: $?2 $?d $?d $?d' -o biblenum7.rule

biblenum* >> bible.rule



append : 1-3 everything

./mp64.bin -1 ?d?s?l?u '$: $?1' -o append1.rule
./mp64.bin -1 ?d?s?l?u '$: $?1 $?1' -o append2.rule
./mp64.bin -1 ?d?s?l?u '$: $?1 $?1 $?1' -o append3.rule

append* >> append.rule



Append clock both 12 and 24 hour

./mp64.bin -1 12 -2 1234 -3 12345 '$?1 $?2 $: $?3 $?d' -o clock.rule

#haven't tried this, most likly to large.
./mp64.bin -1 12 -2 1234 -3 12345 '$?1 $?2 $: $?3 $?d $: $?d $?d' -o clockSeconds.rule




Linkedin Passwords Analysed

Thursday, August 9, 2012 Posted by Unknown 0 comments
Number of Linkedin passwords analysed: 4,769,941

Passpal.rb output. See the full report here. 

I also ran some other reports. Just the masked hashes that were zeroed out for the first 5 bytes can be found here.
Just the normal hashes that didn't have the zeroed out bytes report can be found here. 


Base word (len>=3) frequency, sorted by count, top 20
+-----------------------------+
|   Word   | Count | Of total |
+-----------------------------+
| linkedin |  3674 | 0.077 %  |
| link     |  2282 | 0.0478 % |
| linked   |  1905 | 0.0399 % |
| alex     |  1089 | 0.0228 % |
| mike     |  1075 | 0.0225 % |
| may      |  1032 | 0.0216 % |
| love     |   967 | 0.0203 % |
| Linkedin |   865 | 0.0181 % |
| june     |   860 | 0.018 %  |
| john     |   852 | 0.0179 % |
| blue     |   788 | 0.0165 % |
| jan      |   765 | 0.016 %  |
| jack     |   746 | 0.0156 % |
| july     |   709 | 0.0149 % |
| password |   701 | 0.0147 % |
| sam      |   695 | 0.0146 % |
| pass     |   693 | 0.0145 % |
| chris    |   663 | 0.0139 % |
| mark     |   628 | 0.0132 % |
| dec      |   624 | 0.0131 % |
+-----------------------------+

Length frequency, sorted by length, full table
+------------------------------+
| Length |  Count  | Of total  |
+------------------------------+
|      1 |      28 | 0.0006 %  |
|      2 |      25 | 0.0005 %  |
|      3 |      23 | 0.0005 %  |
|      4 |       5 | 0.0001 %  |
|      5 |       2 | 0.0 %     |
|      6 |  578859 | 12.1354 % |
|      7 |  596636 | 12.5081 % |
|      8 | 1567986 | 32.8718 % |
|      9 |  822634 | 17.246 %  |
|     10 |  567261 | 11.8923 % |
|     11 |  290798 | 6.0964 %  |
|     12 |  174207 | 3.6521 %  |
|     13 |   87247 | 1.8291 %  |
|     14 |   49301 | 1.0336 %  |
|     15 |   23493 | 0.4925 %  |
|     16 |    9970 | 0.209 %   |
|     17 |     801 | 0.0168 %  |
|     18 |     383 | 0.008 %   |
|     19 |     161 | 0.0034 %  |
|     20 |      81 | 0.0017 %  |
+------------------------------+


Charset frequency, sorted by count, full table
+-------------------------------------------------------------------------+
|           Charset            |  Count  | Of total  |   Count/keyspace   |
+-------------------------------------------------------------------------+
| lower-upper-numeric-symbolic | 4707243 | 98.6844 % | 49549.926315789475 |
| lower-upper-numeric          | 4320927 | 90.5855 % |  69692.37096774194 |
| lower-numeric-symbolic       | 3605939 | 75.5962 % | 52259.985507246376 |
| lower-numeric                | 3402358 | 71.3283 % |  94509.94444444444 |
| lower-upper-symbolic         | 1275390 | 26.7377 % | 15004.588235294117 |
| lower-upper                  | 1202678 | 25.2134 % | 23128.423076923078 |
| lower-symbolic               | 1104595 | 23.1571 % | 18721.949152542373 |
| lower                        | 1055703 | 22.1321 % |  40603.96153846154 |
| upper-numeric-symbolic       |  299598 | 6.2809 %  |             4342.0 |
| upper-numeric                |  286005 | 5.9959 %  |  7944.583333333333 |
| numeric-symbolic             |  204379 | 4.2847 %  |             4753.0 |
| numeric                      |  200999 | 4.2138 %  |            20099.9 |
| upper-symbolic               |   28394 | 0.5953 %  |  481.2542372881356 |
| upper                        |   26797 | 0.5618 %  | 1030.6538461538462 |
| symbolic                     |     133 | 0.0028 %  |   4.03030303030303 |
+-------------------------------------------------------------------------+

Charset frequency, sorted by count/keyspace, full table
+-------------------------------------------------------------------------+
|           Charset            |  Count  | Of total  |   Count/keyspace   |
+-------------------------------------------------------------------------+
| lower-numeric                | 3402358 | 71.3283 % |  94509.94444444444 |
| lower-upper-numeric          | 4320927 | 90.5855 % |  69692.37096774194 |
| lower-numeric-symbolic       | 3605939 | 75.5962 % | 52259.985507246376 |
| lower-upper-numeric-symbolic | 4707243 | 98.6844 % | 49549.926315789475 |
| lower                        | 1055703 | 22.1321 % |  40603.96153846154 |
| lower-upper                  | 1202678 | 25.2134 % | 23128.423076923078 |
| numeric                      |  200999 | 4.2138 %  |            20099.9 |
| lower-symbolic               | 1104595 | 23.1571 % | 18721.949152542373 |
| lower-upper-symbolic         | 1275390 | 26.7377 % | 15004.588235294117 |
| upper-numeric                |  286005 | 5.9959 %  |  7944.583333333333 |
| numeric-symbolic             |  204379 | 4.2847 %  |             4753.0 |
| upper-numeric-symbolic       |  299598 | 6.2809 %  |             4342.0 |
| upper                        |   26797 | 0.5618 %  | 1030.6538461538462 |
| upper-symbolic               |   28394 | 0.5953 %  |  481.2542372881356 |
| symbolic                     |     133 | 0.0028 %  |   4.03030303030303 |
+-------------------------------------------------------------------------+


Total characters: 40923061
Unique characters: 343
Top 50 characters: ae1inrosl02tmd3cuhk947b85gp6yjfvwzxASML!BR@CTEDNPI

Character frequency, sorted by count, top 20
+--------------------------------+
| Character |  Count  | Of total |
+--------------------------------+
| a         | 3018713 | 7.3766 % |
| e         | 2503293 | 6.1171 % |
| 1         | 2021211 | 4.9391 % |
| i         | 2015863 | 4.926 %  |
| n         | 1894225 | 4.6287 % |
| r         | 1760160 | 4.3011 % |
| o         | 1723761 | 4.2122 % |

Symbol frequency, sorted by count, top 20
+-----------------+
| Symbol | Count  |
+-----------------+
| !      | 111239 |
| @      | 100945 |
| #      |  44236 |
| .      |  43380 |
| *      |  40449 |
| _      |  32678 |
| -      |  29112 |
| &      |  14655 |









Labels: