Chapter 7

More Advanced Techniques

Before we leave the topic of Hashcat, let’s look at a few more advanced topics. In this chapter we will take a closer look at Hashcat Rule files. We will see how to bring some automation to Mask attacks with “Mask Files”. Take a look at the Prince Processor attack, a unique way to modify attacks with wordlists. Lastly, we will look at some patterns and tools that could make password cracking easier.  

Rules and Mask Files

Rule based attacks

Mentioned briefly before, rule-based attacks can be very useful. Hashcat has a list of built-in rules that you can use to crack passwords. You can find them in the Hashcat “rules” subdirectory. For example, there are “leetspeak” rule sets that automatically takes each dictionary word and tries different leet-speak versions of the word, replacing letters with numbers. You can even use a programming type language to create your own rulesets.

Rule based attacks are use in single attack mode. They are enabled by using the “-r” switch and the name of the ruleset you want:

The Best64, InsidePro, Dive, Rockyou-30000 & d3ad0ne rules are some of the more popular ones and are very effective. My best advice for rules is to start with the smaller rule files (look at their file size) and then move on to the larger ones. The smaller ones usually run fairly quick; the larger ones can take significantly longer to...

Prince Processor Attack

Tool GitHub: https://github.com/hashcat/princeprocessor

Tool Releases: https://github.com/hashcat/princeprocessor/releases

Prince Processor (PP) is an advanced wordlist combinator attack. It can perform complex wordlist attacks using a single wordlist file. First, set a minimum password length, then provide a wordlist to use. PP will then take the length you provided and begin to build words of that length from multiple words in the existing file. So, if you set a word length of 6, it can take all 6 letters from one word, or it can take 1 letter from 6 words, or 2 letters from 3 words, and any combination in between. 

PP then takes these new words and pipes them into hashcat, live on the fly. Hashcat uses the words as a regular wordlist and uses them to crack away. It’s not amazingly fast, but if you run out of other options, it is an interesting technique to use. Prince Processor is available for Linux, Windows and Mac.

Here is an example on Windows...

Password Cracking - Patterns

When cracking passwords, always look for patterns in the cracked passwords. Humans are creatures of habit and the familiar, so there are almost always patterns. Once you have the pattern, then you can create custom wordlists using those patterns. For instance, working through a combined public password dump of passwords that other hackers hadn’t been able to crack yet, I found character codes in the dump. Instead of using the ampersand, apostrophe, quotation marks, less than, or greater than signs when the database stored the hashes, it turned them into HTML (or XML) character codes and then hashed them. So, instead of storing an “&” in the password database, an “&” was stored. Or, the decimal ASCII code was used, “#038”.

Thus, the password “behappy&” became “behappy&”. It was then converted into a hash and stored. When cracking these passwords, you have to...

Using Cracked Passwords to Crack New Passwords

One of the best advanced cracking techniques is to use the passwords that were cracked as a wordlist, and then using them in combo attacks or running rules on them. This is easy to do by parsing the Hashcat cracked output file. The output file will have the original hash, a colon, and then the cracked password. All we need to do is remove the hash and colon, and then re-save the file as a new wordlist.

The Linux text manipulation commands are great for parsing wordlists. In particular the “cut” command. All you need to do is figure out where the hash & colon ends and then cut the passwords out and save them in a new file. In the wordlist example below, the passwords start at column 34.

➢      cut -c34-128 cracked.txt > crackedwl.txt

Another helpful technique when creating your own wordlists or combining existing ones is to sort & remove duplicates:

➢      sort wordlist...

PACK - Password Analysis and Cracking Kit 

Tool Author: Peter Kacherginsky (iphelix)

Tool GitHub: https://github.com/iphelix/pack

Lastly, let’s take a quick look at a couple other useful password tools. PACK is a collection of tools for advanced password analysis and cracking. PACK makes it very easy to analyze statistics and create masks and rules. 

➢      git clone https://github.com/iphelix/pack.git

Analyzing a cracked wordlist for patterns and statistics:

➢      python2 statsgen.py crackedwl.txt

You can use the tools from the PACK kit to creating masks from wordlists:

➢      statsgen.py crackedwl.txt -o crackedwl.masks

➢      maskgen.py crackedwl.masks --occurrence -q -o crackedwl.hcmask

(You can also use, “--targettime” to limit cracking times)

You now have a file that contains cracking masks for hashcat:

This returns a huge number of masks, and as you can see...