08-15-2016, 08:38 PM
(08-15-2016, 01:54 PM)Kgx Pnqvhm Wrote: Update: Matt has a Sunday, August 14, 2016 blog post titled "Evaluating the Value of the (@)Purge Rule" at http://reusablesec.blogspot.com/2016/08/...-rule.html.
You beat me to to that
Long story short, the newest version of Hashcat supports purge rules now so this problem has pretty much been solved. Even if that hadn't happened, it appears that purge rules have only a minimal impact on the success of a cracking session.
As a side note, John the Ripper supports:
@?C purge all characters of class C from the word
I didn't run any tests on that, but my gut feeling is that it wouldn't be that useful except as part of a --loopback style attack or cleaning up an input dictionary. For example, let's say you have a cracking session and crack "password123". You might want to strip off all digits and special characters and then retry the base word with other mangling rules applied to it. A purge all character class rule might help with that. Aka it's a rule that helps simplify your workflow, (don't need to run your crack list through another program to clean it up), vs a rule to mimic user behavior to crack their passwords.