Incremental Markov attacks - Printable Version

Incremental Markov attacks - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Incremental Markov attacks (/thread-6574.html)

Incremental Markov attacks - nullcell - 05-16-2017

Hi all,
I'm trying to understand Markov chains in relation to incremental brute force attacks a little better and was playing around with masks over the weekend. I'm not actually trying to crack anything, just learning about Markov.

Let's assume I have some awesome hardware (better than the stats below) and wanted to brute force a WPA2 handshake by way of an incremental attack starting at 8 and ending with 50 using the following

Code:
hashcat64 -w 4 --restore-file-path=~/my.restore -o ~/cracked.txt -m 2500 -a 3  --increment --increment-min=8 --increment-max=50 handshakes.hccapx ?a?a?a?a?a?a?a?a

I might get the following output

Code:
Session..........: hashcat

Status...........: Running

Hash.Type........: WPA/WPA2

Hash.Target......: handshakes.hccapx

Time.Started.....: xxxxxxx (9 hours, 30 mins)

Time.Estimated...: xxxxxx (3 years, 61 days)

Guess.Mask.......: ?a?a?a?a?a?a?a?a [8]

Guess.Queue......: 1/1 (100.00%)

Speed.Dev.#1.....:    98261 H/s (55.75ms)

Recovered........: 0/80 (0.00%) Digests, 0/24 (0.00%) Salts

Progress.........: 94919065600/159220903509375000 (0.00%)

Rejected.........: 0/94919065600 (0.00%)

Restore.Point....: 41615360/69833729609375 (0.00%)

Candidates.#1....: hH2Pmane -> hXU<LINA

HWMon.Dev.#1.....: Temp: 59c Fan:100% Util: 98% Core:1024MHz Mem:1333MHz Bus:16

My question is specific to how Markov chains increment. Let's take Candidates.#1 as an example

Code:
Candidates.#1....: hH2Pmane -> hXU<LINA

Even though I'm able to crack through 98261 H/s, I've noticed when checking the status, there are times where the progress moves forward but the candidates do not changes for X seconds. Let's call it 15 seconds which got me thinking.

How exactly does Markov increment in hashcat? Will hashcat start with the first 8 character candidate and work it's way to the last 8 character candidate before it increments?

Or will the Markov chain increment the current candidate until the max length is reached before moving on to the next?

Example

Code:
"aaaaaaaa"

"aaaaaaab"

"aaaaaaac"

"aaaaaaad"

and so on until all possible 8 character combinations are satisfied

or

Code:
"aaaaaaaa"

"aaaaaaaab"

"aaaaaaaabc"

and so on until the current candidate has tried all possible combinations between 8 and 50?

I don't fully understand Markov chains yet so it's difficult to articulate my question in exactly the right way, please ask if you have any questions about what I'm asking.

RE: Incremental Markov attacks - royce - 05-16-2017

Yes, in incremental mode, a length will be exhausted before the next length is started.

Also, the Candidate progress display shows a range. It is normal for this to only change when another range is started.