INIT_6

Link to information about Hashcat rule based attack.

Besides the out of box rules and some of the amazing rules atom and his team comes up with. I will be updating this post from time to time adding new rules I come up with or others give me the idea to come up with.

malik51: and i where talking. I was trying to get ?d?s to be preappended and appended to a pass. As running two rules one appending and one preappending is slow and doesn't work.  After much frustration I had one good idea what I will share below. His solution.

./mp64.bin -1 ?d?s '$?1 $?1 Y2 }}' -o malik51roll2.rule
./mp64.bin -1 ?d?s '$?1 $?1 $?1 Y3 }}}' -o malik51roll3.rule

This will add the same to both sides. !@pass!@ or 123pass123. Works great, and its fast.

However, I wanted more.  I wanted passwords like 1@pass$% or 123pass#$%  What I thought was the solution to the above actual works for this. It will first reverse the pass. ssap then append the digit or special character ssap@1 then reverse the word again. 1@pass  Then finally append the next set to get you 1@pass$%

./mp64.bin -1 ?d?s 'r $?1 $?1 r $?1 $?1' -o init6reverse.rule

However, this only works for two spots. you cant do 123pass#$% just to big.

In the spirit of the malik51roll2.rule I made the ldsUroll.rule
./mp64.bin -1 ?l?d?s?u '$?1 $?1 Y2 }}' -o ldsUroll.rule
It appends and presppends lowercase, digits, special, and uppercase.


EDIT: 8/12/2012 4:13AM

The following haven't found that many, but they found some.


bible verse numbers:

./mp64.bin -1 123456 -2 12 '$: $?d $?d' -o biblenum1.rule
./mp64.bin -1 123456 -2 12 '$: $1 $?d $?d' -o biblenum2.rule
./mp64.bin -1 123456 -2 12 '$  $: $?d $?d' -o biblenum1a.rule
./mp64.bin -1 123456 -2 12 '$  $: $1 $?d $?d' -o biblenum2a.rule
./mp64.bin -1 123456 -2 12 '$?d $: $?d $?d' -o biblenum3.rule
./mp64.bin -1 123456 -2 12 '$?d $: $1 $?d $?d' -o biblenum4.rule
./mp64.bin -1 123456 -2 12 '$?1 $?d $: $?d $?d $?d' -o biblenum5.rule
./mp64.bin -1 123456 -2 12 '$?1 $?d $: $1 $?d $?d $?d' -o biblenum6.rule
./mp64.bin -1 123456 -2 12 '$1 $5 $0 $: $?2 $?d $?d $?d' -o biblenum7.rule

biblenum* >> bible.rule



append : 1-3 everything

./mp64.bin -1 ?d?s?l?u '$: $?1' -o append1.rule
./mp64.bin -1 ?d?s?l?u '$: $?1 $?1' -o append2.rule
./mp64.bin -1 ?d?s?l?u '$: $?1 $?1 $?1' -o append3.rule

append* >> append.rule



Append clock both 12 and 24 hour

./mp64.bin -1 12 -2 1234 -3 12345 '$?1 $?2 $: $?3 $?d' -o clock.rule

#haven't tried this, most likly to large.
./mp64.bin -1 12 -2 1234 -3 12345 '$?1 $?2 $: $?3 $?d $: $?d $?d' -o clockSeconds.rule

Number of Linkedin passwords analysed: 4,769,941

Passpal.rb output. See the full report here. 

I also ran some other reports. Just the masked hashes that were zeroed out for the first 5 bytes can be found here.
Just the normal hashes that didn't have the zeroed out bytes report can be found here. 


Base word (len>=3) frequency, sorted by count, top 20
+-----------------------------+
|   Word   | Count | Of total |
+-----------------------------+
| linkedin |  3674 | 0.077 %  |
| link     |  2282 | 0.0478 % |
| linked   |  1905 | 0.0399 % |
| alex     |  1089 | 0.0228 % |
| mike     |  1075 | 0.0225 % |
| may      |  1032 | 0.0216 % |
| love     |   967 | 0.0203 % |
| Linkedin |   865 | 0.0181 % |
| june     |   860 | 0.018 %  |
| john     |   852 | 0.0179 % |
| blue     |   788 | 0.0165 % |
| jan      |   765 | 0.016 %  |
| jack     |   746 | 0.0156 % |
| july     |   709 | 0.0149 % |
| password |   701 | 0.0147 % |
| sam      |   695 | 0.0146 % |
| pass     |   693 | 0.0145 % |
| chris    |   663 | 0.0139 % |
| mark     |   628 | 0.0132 % |
| dec      |   624 | 0.0131 % |
+-----------------------------+

Length frequency, sorted by length, full table
+------------------------------+
| Length |  Count  | Of total  |
+------------------------------+
|      1 |      28 | 0.0006 %  |
|      2 |      25 | 0.0005 %  |
|      3 |      23 | 0.0005 %  |
|      4 |       5 | 0.0001 %  |
|      5 |       2 | 0.0 %     |
|      6 |  578859 | 12.1354 % |
|      7 |  596636 | 12.5081 % |
|      8 | 1567986 | 32.8718 % |
|      9 |  822634 | 17.246 %  |
|     10 |  567261 | 11.8923 % |
|     11 |  290798 | 6.0964 %  |
|     12 |  174207 | 3.6521 %  |
|     13 |   87247 | 1.8291 %  |
|     14 |   49301 | 1.0336 %  |
|     15 |   23493 | 0.4925 %  |
|     16 |    9970 | 0.209 %   |
|     17 |     801 | 0.0168 %  |
|     18 |     383 | 0.008 %   |
|     19 |     161 | 0.0034 %  |
|     20 |      81 | 0.0017 %  |
+------------------------------+


Charset frequency, sorted by count, full table
+-------------------------------------------------------------------------+
|           Charset            |  Count  | Of total  |   Count/keyspace   |
+-------------------------------------------------------------------------+
| lower-upper-numeric-symbolic | 4707243 | 98.6844 % | 49549.926315789475 |
| lower-upper-numeric          | 4320927 | 90.5855 % |  69692.37096774194 |
| lower-numeric-symbolic       | 3605939 | 75.5962 % | 52259.985507246376 |
| lower-numeric                | 3402358 | 71.3283 % |  94509.94444444444 |
| lower-upper-symbolic         | 1275390 | 26.7377 % | 15004.588235294117 |
| lower-upper                  | 1202678 | 25.2134 % | 23128.423076923078 |
| lower-symbolic               | 1104595 | 23.1571 % | 18721.949152542373 |
| lower                        | 1055703 | 22.1321 % |  40603.96153846154 |
| upper-numeric-symbolic       |  299598 | 6.2809 %  |             4342.0 |
| upper-numeric                |  286005 | 5.9959 %  |  7944.583333333333 |
| numeric-symbolic             |  204379 | 4.2847 %  |             4753.0 |
| numeric                      |  200999 | 4.2138 %  |            20099.9 |
| upper-symbolic               |   28394 | 0.5953 %  |  481.2542372881356 |
| upper                        |   26797 | 0.5618 %  | 1030.6538461538462 |
| symbolic                     |     133 | 0.0028 %  |   4.03030303030303 |
+-------------------------------------------------------------------------+

Charset frequency, sorted by count/keyspace, full table
+-------------------------------------------------------------------------+
|           Charset            |  Count  | Of total  |   Count/keyspace   |
+-------------------------------------------------------------------------+
| lower-numeric                | 3402358 | 71.3283 % |  94509.94444444444 |
| lower-upper-numeric          | 4320927 | 90.5855 % |  69692.37096774194 |
| lower-numeric-symbolic       | 3605939 | 75.5962 % | 52259.985507246376 |
| lower-upper-numeric-symbolic | 4707243 | 98.6844 % | 49549.926315789475 |
| lower                        | 1055703 | 22.1321 % |  40603.96153846154 |
| lower-upper                  | 1202678 | 25.2134 % | 23128.423076923078 |
| numeric                      |  200999 | 4.2138 %  |            20099.9 |
| lower-symbolic               | 1104595 | 23.1571 % | 18721.949152542373 |
| lower-upper-symbolic         | 1275390 | 26.7377 % | 15004.588235294117 |
| upper-numeric                |  286005 | 5.9959 %  |  7944.583333333333 |
| numeric-symbolic             |  204379 | 4.2847 %  |             4753.0 |
| upper-numeric-symbolic       |  299598 | 6.2809 %  |             4342.0 |
| upper                        |   26797 | 0.5618 %  | 1030.6538461538462 |
| upper-symbolic               |   28394 | 0.5953 %  |  481.2542372881356 |
| symbolic                     |     133 | 0.0028 %  |   4.03030303030303 |
+-------------------------------------------------------------------------+


Total characters: 40923061
Unique characters: 343
Top 50 characters: ae1inrosl02tmd3cuhk947b85gp6yjfvwzxASML!BR@CTEDNPI

Character frequency, sorted by count, top 20
+--------------------------------+
| Character |  Count  | Of total |
+--------------------------------+
| a         | 3018713 | 7.3766 % |
| e         | 2503293 | 6.1171 % |
| 1         | 2021211 | 4.9391 % |
| i         | 2015863 | 4.926 %  |
| n         | 1894225 | 4.6287 % |
| r         | 1760160 | 4.3011 % |
| o         | 1723761 | 4.2122 % |

Symbol frequency, sorted by count, top 20
+-----------------+
| Symbol | Count  |
+-----------------+
| !      | 111239 |
| @      | 100945 |
| #      |  44236 |
| .      |  43380 |
| *      |  40449 |
| _      |  32678 |
| -      |  29112 |
| &      |  14655 |

To search for SHA1 in file:
cat FILE | grep -o -E -e "[0-9a-f]{40}" | sort | uniq -u > all-SHA1

To search for SHA-256 in file:
cat FILE | grep -o -E -e "[0-9a-f]{64}" | sort | uniq -u > all-SHA256

To search for SHA-512 in file:
cat FILE | grep -o -E -e "[0-9a-f]{128}" | sort | uniq -u > all-SHA512

To search for MD5 in file:
cat FILE | grep -o -E -e "[0-9a-f]{32}" | sort | uniq -u > all-md5

To search for MD5crypt in file:
cat FILE | grep '^\$1\$' | cut -d: -f2- | sort | uniq -u > all-md5crypt

To search for NTLM in file:
cat FILE | grep -o -E -e ':\$NT\$[[:alnum:]]{32}:' | sort | uniq -u > all-NTLM
cat FILE | grep -o -E -e ':\$NT\$[[:alnum:]]{30,34}:' | sort | uniq -u > all-NTLM

Cross-Site-Scripting preset list for Burp suite.

Download the file. http://pastie.org/4160616 you can just save it as a .txt file and load it in the intruder as a preset file. File includes Alert and Prompt. Prompt helps when Alert has been filtered.

If you don't know how to use Burp here is a pretty good tutorial

In the Texas area I have noticed that all Time Warner Cable wireless access points are setup with the home owners home phone number. 


When I say all I really mean the 3 I have ran across but close enough for me. 


Using http://www.telcodata.us/ collected data for all phone numbers in Texas that belong to Time Warner. Cleaned the file up using a quick and dirty python program. TimeWarnerNum.dict 


First you need to collect the 4-way handshake.


Using oclHashCat-Plus to crack the WPA1/2 password. This is optimized for my AMD graphics card you can change the settings for your card. 


./oclHashcat-plus -m 2500 capture.hccap -a 6 -o TimeWarnerNum.dict ?d?d?d?d --output-format=6 --gpu-accel=32 --gpu-loops=256 --perm-min=10 --perm-max=10


This will append every possible digit to all the numbers Time Warner own. Because they own subset numbers like 972-966-7 if you don't set the min and max to 10 you will create 11 digit numbers.

Getting Pyrit to work with OpenCL and posgreSQL database. On Kubuntu 12.04 With a AMD Radon HD 7950 card.


You have to install AMD catalysis drivers and the AMD SDK. Make sure you install whatever one is older first then the newer one so you don't corrupt your install. This will change as they update the catalysis drivers and the SDK at different times. 


Go AMD and download and install the drivers for your card. here  
This page will help you install your drivers. here


Restart after install.


Download the latest SDK. here
This page will help you install your SDK. here


Restart after install.


name@box$: env


Check and make sure you have the following:


AMDAPPSDKROOT =/opt/AMDAPP/
LD_LIBRARY_PATH=/opt/AMDAPP/lib


Make sure everything is running correctly and the protocol is running by:
This has to be ran as a normal user. Application doesn't work as root.
name@box$: fglrxinfo




Some decencies that I ran into. This list my not be complete. 

apt-get install cmake libroot-python-dev libboost1.40-all-dev subversion libpcap-dev libssl-dev python-dev zlib1g-dev python-scapy libpcap0.8-dev libpq-dev 


install easy_install fuction. Follow the steps here
Now you can run:


name@box$: sudo easy_install SQLAlchemy
name@box$: sudo easy_install psycopg2



Now we are ready to install pyrit.


name@box$: wget https://pyrit.googlecode.com/files/pyrit-0.4.0.tar.gz
name@box$: wget https://pyrit.googlecode.com/files/cpyrit-opencl-0.4.0.tar.gz


name@box$ tar xvzf pyrit-0.4.0.tar.gz
name@box$ tar xvzf cpyrit-opencl-0.4.0.tar.gz


name@box$ cd pyrit-0.4.0
name@box$ sudo python setup.py build
name@box$ sudo python setup.py install


name@box$ cd ../cpyrit-opencl-0.4.0
name@box$ nano setup.py


You need to edit the setup.py file to match the below:




LIBRARIES.append('OpenCL') 
try: if os.path.exists(os.environ['AMDAPPSDKROOT']): OPENCL_INC_DIRS.append(os.path.join(os.environ['AMDAPPSDKROOT'], 'include')) 
    for path in ('lib/x86_64','lib/x86'): 
         if       os.path.exists(os.path.join(os.environ['AMDAPPSDKROOT'], path)):  OPENCL_LIB_DIRS.append(os.path.join(os.environ['AMDAPPSDKROOT'], path)) break except: pass for path in ('/opt/AMDAPP/include', \ '/opt/AMDAPP/include/CL'):


ctrl+o to save
ctrl+x to exit


name@box$ sudo python setup.py build
name@box$ sudo python setup.py install




install postgresql 9 from website
install pgadmin3 from ubuntu software center.


Setup new user and database. 
User:2wire 
password: putitinme  
Database: 2wireDB


To have pyrit connect to your database do the following
name@box$ pyrit -u postgresql://2wire:putitinme@127.0.0.1/2wireDB [pyrit command]


Now if you don't want to type out all that non-sense each time edit the following file:


name@box$ nano ~./pyrit/config


Change where it says file:// to read postgresql://2wire:putitinme@127.0.0.1/2wireDB


Ctrl+o to save
Ctrl+x to exit


now you can simply run pyrit


name@box$ pyrit [pyrit command]


Now it will automatically connect to the database. 


Might have left out a few steps if you run across this page and need some help feel free to hit me up. I know pages just like this helped me install pyrit.

Quick way to get a decent speed test on the command line.








#!/bin/bash
curl -o /dev/null http://download.thinkbroadband.com/1GB.zip