Hello hashmashers!
I'm new to hashcat, got recommended by a friend.
I wanted to present a case of a double crack that is staring back at me :3
1) Is the following a lost cause?
bis) If not, what is the best strategy given what I believe to be true about the password?
1) Double crack:
a. Rar archive (encrypted in 2017): $RAR3$ ... *33
b. Ethereum keystore (created via the Mist wallet)
> What I believe to be true about the password:
-> Consists of words; best case = English only, worst case = English + Dutch
-> Can contain names (e.g: Bilbo) (but very unlikely, ignore this for evaluation)
-> Can contain upper case letters; best case = Only first letter, worst case = CamelCasing
-> Can contain numbers, reduced to "1", "5", "8", used at the end, only could be followed by max 5 characters
E.g: "xoxo!"
-> Have a list of specific numbers that can be in there
E.g: "123581321"
-> Can contain special symbols, reduced to "!" and "$", used only at the end
-> Length estimation: Min length = 8, max length = 18
(!) It could be real bad and be closer the amount of char of the file name = 29
(!) But in the case of 29, it's likely to be related to words used in the file name (dutch)
(!) Let's ignore the real bad case identified with (!) because very unlikely
bis) Strategy?
Do I compile a word list with all the typical words/numbers/symbols I use in my passwords?
=> Word lists + mask? What mask format tho? Have trouble coming up with a comprehensive one that covers the load
=> English + Dutch dictionary?
=> Brute force? How long would worst case take with a typical hash rate machine that can be found with AWS?
I hope to be able to say once the double crack is done: "Aaaaaaaand that's the way the cookie crumbles"
*Jim Carrey face*
I'm new to hashcat, got recommended by a friend.
I wanted to present a case of a double crack that is staring back at me :3
1) Is the following a lost cause?
bis) If not, what is the best strategy given what I believe to be true about the password?
1) Double crack:
a. Rar archive (encrypted in 2017): $RAR3$ ... *33
b. Ethereum keystore (created via the Mist wallet)
> What I believe to be true about the password:
-> Consists of words; best case = English only, worst case = English + Dutch
-> Can contain names (e.g: Bilbo) (but very unlikely, ignore this for evaluation)
-> Can contain upper case letters; best case = Only first letter, worst case = CamelCasing
-> Can contain numbers, reduced to "1", "5", "8", used at the end, only could be followed by max 5 characters
E.g: "xoxo!"
-> Have a list of specific numbers that can be in there
E.g: "123581321"
-> Can contain special symbols, reduced to "!" and "$", used only at the end
-> Length estimation: Min length = 8, max length = 18
(!) It could be real bad and be closer the amount of char of the file name = 29
(!) But in the case of 29, it's likely to be related to words used in the file name (dutch)
(!) Let's ignore the real bad case identified with (!) because very unlikely
bis) Strategy?
Do I compile a word list with all the typical words/numbers/symbols I use in my passwords?
=> Word lists + mask? What mask format tho? Have trouble coming up with a comprehensive one that covers the load
=> English + Dutch dictionary?
=> Brute force? How long would worst case take with a typical hash rate machine that can be found with AWS?
I hope to be able to say once the double crack is done: "Aaaaaaaand that's the way the cookie crumbles"
*Jim Carrey face*