Hybrid attack query

[robertf]

Hi

I running 4 x AMD r9 280, i7 3.7Ghz, windows 7 (couldn't get ubuntu to install with the UEFI board/bios)

I know the Passwords start with days of the week and end in numbers like years etc , so I created a dictionary to recover the easy DES hashes

Monday
Monda
Mond
Mon
Tuesday
Tuesda
.
.
.
Friday
Frida
etc etc

I also added lowercase starts for the days.

I then ran a hybrid attack -

oclhashcat64.exe -a 6 -m 1500 --remove --session=rob --gpu-temp-abort=95 --outfile-format=3 --outfile=recovered.txt e:\hashes f:\wordlist ?d

I ran the same command using ?d?d and ?d?d?d and ?d?d?d?d and finally ?d?d?d?d?d

It did recover some hashes.

Later I ran a brute force attack using the below after applying many more mask combinations and other dictionaries -

oclhashcat64.exe -a 3 -m 1500 -1 ?u?l -2 ?l?d --remove --session=rob --gpu-temp-abort=95 --outfile-format=3 --outfile=recovered.txt e:\hashes ?1?2?2?2?2?2?2

It then recovered passwords like Monday1, Fri2003 etc

I would have expected to have recovered these from the hybrid attack?

comments please

Rob

[kartan]

Besides that your approach is exceptional inefficient it is correct. Your initial way of building that wordlist and doing a -a6 with ?d-?d?d?d?d will yield you exactly that what you asked for.

My guess is that you goofed something in your wordlist since you did not post exactly what got cracked in both attempts.

[robertf]

Thanks for your response.

Which approach is inefficient my overall approcah or the actual attack modes - hybrid or brute force? The brute force only took a day (24 hrs) and recovered 90% of the 3000 hashes.

The dict was pretty simple...and repetative

Sampe hybrid passwords recovered Thu20030, monday4,monday21, monday10 etc

Sample bruteforce passwords recovered Monday1, Fri2003, Tuesday1, friday6

At first I thought it was a case issue, but checked the dict file and they were all present for the hybrid (dict + mask) attack

I also has similar issues with months like aug01, nov02, april03..some being found in hybrid others in bruteforce but all lowercase were present in the dictionaly for the hybrid attack...

[kartan]

As I said, you should check your wordlist for errors like spaces before newlines or charset issues with the editor you worked since you are under windows.