+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Replace rule - but not all at once (/thread-7768.html)
Replace rule - but not all at once - psit - 08-28-2018
Is there any way to make a replace rule that replaces A for B, but each occurrence of A at a time? So that the word "sorry" and rule "srR" (for example) would generate "sorRy", "soRry" and "soRRy"?
Or any combination of rules, of course.
Thx in advance.
RE: Replace rule - but not all at once - philsmd - 08-28-2018
see the rules page on the wiki: https://hashcat.net/wiki/doku.php?id=rule_based_attack#using_p_nth_instance_of_a_character_with_positional_rules
RE: Replace rule - but not all at once - psit - 08-28-2018
(08-28-2018, 05:03 PM)philsmd Wrote: see the rules page on the wiki: https://hashcat.net/wiki/doku.php?id=rule_based_attack#using_p_nth_instance_of_a_character_with_positional_rules
But the wiki says:
"Note that rules that use the 'p' character position code only works using the '-j' or '-k' command-line options."
i.e.: not in rule files.
What if I had to apply multiple substitutions, like "a" for "@" and "i" for "1" etc...?
RE: Replace rule - but not all at once - philsmd - 08-29-2018
multiple substitutions should be no problem because currently a single rule could consist of up to 31 rule functions: https://hashcat.net/wiki/doku.php?id=rule_based_attack#limitations
The only problem could be if you need to use very distinct rules with positional rule functions. btw: -j and -r can be combined too (therefore you could apply the positional rules with -j/-k and add some further rules with a set or rule files (-r).
Alternatively, you could use "-a 0 --stdout -j ..." to mangle a small dict with all the different rules you need (even with several -j runs redirected into one file, and ideally uniqued afterwards) and use this pre-generated dict file as input for hashcat. Of course it depends a lot on how large the original dict is and how feasible it is to use the disk etc. You could limit the -j to just positional rules and use -r later on for all other rules. You could also use pipes instead, but that has also some disadvantages.
As you can see, there are many possibilities and it's quite easy to work with this limitation of just being able to use -j/-k.
btw if you only need to toggle, like in your example (no complicated substitutions with multiple characters as a replacement for 1 single character etc), you could just use a set of toggle rules:
Code:
T0
T1
T2
T3
T4
T5
T6
T7
T0 T1
T0 T2
T0 T3
T0 T4
# ...
T1 T2
T1 T3
T1 T4
# ...etc
RE: Replace rule - but not all at once - Nay - 08-29-2018
Hi,
I had a similar issue few time ago, the best way was for me to use the table attack from hashcat legacy. It worked like a charm : https://hashcat.net/forum/thread-7730.html