How to become proficient at password cracking?
#7
(01-20-2024, 01:52 PM)monyanus Wrote: For sure,a large part it is practice and experience. For example, knowing a) which attack type to use in which situation and b) how to avoid checking unneeded options, makes a tremendous difference and is more important than expensive hardware.
For example, will your hybrid attack contain ?d?d?d?d for a year, or will it be -1 12 -2 90 ?1?2?d?d. The later option is 25x faster. An even better option would be to use a rule set for common dates, perhaps followed by a special character. Especially when a small mask is first and the word list is second in a hybrid attack, it becomes slow. Rule sets do not have this problem, whether it is append or prepend, hence it can be a better solution than hybrid attacks which rely on a mask.
Another booster is the ability to use left (-j) and right (-k) rules in hybrid attacks, they can make your life much easier and are often overlooked by beginning hashcat users.

With regards to theory, it is important to understand bottlenecks and how to supply more work as well as reading on the forum and wiki in general:
https://hashcat.net/faq/morework

Last tip, when I started understanding and building my own rule sets, I noticed I jumped in my capacity to crack hashes. Using rules is the most powerful tool hashcat has to offer, they are very much worth learning.
Another thing to understand that the skills you have to learn depend on whether you want to crack many hashes in a database/breach, or if you want to help a specific client. The skills are different. In the first case you focus on general password patterns and systematic rules such length, while in the later you translate the clients mind and way of thinking into custom masks and rule sets.

well maybe we have a different view on that, but all of your examples, especially with dates in my view is all about theory, of course it is faster, because of reduced keyspace but this has nothing to do with "practice".

when i want to add common dates with rules or masks, for sure i dont use ?d?d?d?d, but this thinking is done before and not after i see: oh hashcat is testingĀ  3000-9999 also, but dont needed, so this is plain "theory"

never the less, a good overview by monyanus
Reply


Messages In This Thread
RE: How to become proficient at password cracking? - by Snoopy - 01-22-2024, 02:20 PM