Posts: 6
Threads: 3
Joined: Feb 2014
Hi,
I'd like to prepend "http://" to every entry in my dictionary file, how can I do this with normal hashcat? Seems like it is possible with the hybrid attack in ocl hashcat like this?
./oclHashcat64.bin -m 0 -a 1 hashes.txt ^h^t^t^p^:^/^/ dictionary.txt
But I can only use the normal hashcat and it doesn't work, I simply get "^h^t^t^p^:^/^/: No such file or directory".
Posts: 347
Threads: 3
Joined: May 2010
03-16-2014, 09:24 PM
(This post was last modified: 03-16-2014, 09:25 PM by Xanadrel.)
You can use a rule file, see :
https://hashcat.net/wiki/doku.php?id=rule_based_attack
Also note that combination attack is different between oclHashcat and hashcat, in oclHashcat it combines 2 wordlists, in hashcat it combines each word of a single wordlist.
Posts: 6
Threads: 3
Joined: Feb 2014
03-16-2014, 09:33 PM
(This post was last modified: 03-16-2014, 09:34 PM by questme.)
Thanks for your very fast response! I already found the rule based attack, but it didn't work out. I tried running:
./hashcat-cli64.bin -m 0 -r rule-http-prepend.txt hashes.txt dictionary.txt
where in rule-http-prepend.txt the content is ^h^t^t^p^:^/^/ or the same with a linebreak after every ^h etc. Loads the rule but doesn't find my testhash
Posts: 3
Threads: 0
Joined: Jan 2013
If you use ^h^t^t^p^:^/^/, since the rules are read from left to right, you prepend //:ptth to each word in your dict (^h prepends h, but then ^t prepends t -> th with the previous one, etc…).
Posts: 347
Threads: 3
Joined: May 2010
Yes it's because the ^ (prepend rule) ... prepends so if your plain is "password" and your rule is "^t^h^e" for example, it will result in "ehtpassword".
I hope you see what you have to change now
Posts: 6
Threads: 3
Joined: Feb 2014
Perfect, works great, thank you very much!
Now as a last question is there a way to write the rule directly in the command instead of "outsourcing" it to an extra file? Something like:
./hashcat-cli64.bin -m 0 -r '^/^/^:^p^t^t^h' ../hashes.txt ../dictionary.txt
Posts: 347
Threads: 3
Joined: May 2010
No, except in oclHashcat where you can use -j and/or -k.