--limit and --skip usage - Printable Version

--limit and --skip usage - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: --limit and --skip usage (/thread-6814.html)

--limit and --skip usage - Larrax - 08-25-2017

Hello, I would like to ask you about functionality of the --skip and --limit parameters.

Let me show you my problem on an example.

First I checked hashcat-keyspace of 8x ?l mask:

Code:
hashcat64.exe -a 3 --keyspace ?l?l?l?l?l?l?l?l

11881376

OK, so about 12 milion indexes, I tried to search the first half of some testing Office document.

Code:
hashcat64.exe -a 3 -m 9700 -s 0 -l 6000000 xlsTest.hash ?l?l?l?l?l?l?l?l

That took me about 1.5 minute. Let's now finish the second half, skip the first 6mil indexes and...

Code:
hashcat64.exe -a 3 -m 9700 -s 6000000 xlsTest.hash ?l?l?l?l?l?l?l?l

Time remaining: One hour+.

Could you please clarify what exactly is entered into skip and limit parameters, when not the hashcat-keyspace?

I noticed, for the first limit, 6mil, hashcat tried about 4 bilions passwords. And maximum --skip parameter value hashcat allowed here is much smaller then real keyspace (cosnidering 26^8 = 208 bilion and maximum --skip value here is something about 300 milions), so neither the real keyspace is used in limit nor skip arguments.

Looking forward to your answer!

RE: --limit and --skip usage - philsmd - 08-25-2017

your examples above have 2 different masks:

you used ?l?l?l?l?l?l?l?l for the keyspace calculation and ?l?l?l?l?l?l?l? for the actual run.

You should always use the same mask!

Furthermore, you should have also used this command instead:

Code:
hashcat64.exe -a 3 -m 9700 --keyspace ?l?l?l?l?l?l?l?l

The hash type is sometimes important when using --keyspace, so you better always specify it.

BTW: for office documents (of the same type as 9700) there are the collider modes (-m 9710 and -m 9720) which depending on the mask (or password policy etc) should make it even more easier for you to quickly access the data

RE: --limit and --skip usage - Larrax - 08-25-2017

Sorry, that was just a typo I did in a post (I will edit it). I ran the computation always with mask ?l?l?l?l?l?l?l?l.

Thanks for the answer, this clarifies everything!