+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Deprecated; Previous versions (https://hashcat.net/forum/forum-29.html)
+--- Forum: Old oclHashcat Support (https://hashcat.net/forum/forum-38.html)
+--- Thread: Hybrid attack query (/thread-4237.html)
Hybrid attack query - robertf - 03-31-2015
Hi
I running 4 x AMD r9 280, i7 3.7Ghz, windows 7 (couldn't get ubuntu to install with the UEFI board/bios)
I know the Passwords start with days of the week and end in numbers like years etc , so I created a dictionary to recover the easy DES hashes
Monday
Monda
Mond
Mon
Tuesday
Tuesda
.
.
.
Friday
Frida
etc etc
I also added lowercase starts for the days.
I then ran a hybrid attack -
oclhashcat64.exe -a 6 -m 1500 --remove --session=rob --gpu-temp-abort=95 --outfile-format=3 --outfile=recovered.txt e:\hashes f:\wordlist ?d
I ran the same command using ?d?d and ?d?d?d and ?d?d?d?d and finally ?d?d?d?d?d
It did recover some hashes.
Later I ran a brute force attack using the below after applying many more mask combinations and other dictionaries -
oclhashcat64.exe -a 3 -m 1500 -1 ?u?l -2 ?l?d --remove --session=rob --gpu-temp-abort=95 --outfile-format=3 --outfile=recovered.txt e:\hashes ?1?2?2?2?2?2?2
It then recovered passwords like Monday1, Fri2003 etc
I would have expected to have recovered these from the hybrid attack?
comments please
Rob
RE: Hybrid attack query - kartan - 03-31-2015
Besides that your approach is exceptional inefficient it is correct. Your initial way of building that wordlist and doing a -a6 with ?d-?d?d?d?d will yield you exactly that what you asked for.
My guess is that you goofed something in your wordlist since you did not post exactly what got cracked in both attempts.
RE: Hybrid attack query - robertf - 04-01-2015
Thanks for your response.
Which approach is inefficient my overall approcah or the actual attack modes - hybrid or brute force? The brute force only took a day (24 hrs) and recovered 90% of the 3000 hashes.
The dict was pretty simple...and repetative
Sampe hybrid passwords recovered Thu20030, monday4,monday21, monday10 etc
Sample bruteforce passwords recovered Monday1, Fri2003, Tuesday1, friday6
At first I thought it was a case issue, but checked the dict file and they were all present for the hybrid (dict + mask) attack
I also has similar issues with months like aug01, nov02, april03..some being found in hybrid others in bruteforce but all lowercase were present in the dictionaly for the hybrid attack...
RE: Hybrid attack query - kartan - 04-01-2015
As I said, you should check your wordlist for errors like spaces before newlines or charset issues with the editor you worked since you are under windows.