Issue with custom rules

[mokahless]

I'm new to oclhashcat and I'm currently having an issue with the rules. since a combinator attack is limited to two dictionaries, I've had to implement rules to help me test a password.

The password I am looking to crack is testbanana123, no capitals. The dictionaries only contain 3 words, for testing. They are identical but they both contain "test" and "banana"

I used maskprocessor to create a rules file containing on separate lines from $0 $0 $0 to $9 $9 $9. I then verified my understanding that I was creating the rules properly by using hashcat-cli stdout (since oclhashcat doesn't have an equivalent). hashcat-cli command is as follows:

hashcat-cli64.exe -m xxxx -r rules/xxx.rule hash.txt dictionary1.txt dictionary2.txt -stdout

It output a lot of passwords, including my test password.

My final oclhashcat command:
oclhashcat64.exe -m xxxx -r rules/xxx.rule hash.txt dictionary1.txt dictionary2.txt

My final oclhashcat command, however, did not find the correct password, exhausting the list.


So what am I doing wrong or not understanding?

[epixoip]

Specifying two wordlists in -a 0 doesn't combine the wordlists, it just runs them in serial. So your command was analogous to the following two commands:

Code:

oclhashcat64 hash.txt dictionary1.txt -r rules/xxx.rule
oclhashcat64 hash.txt dictionary2.txt -r rules/xxx.rule

To combine the wordlists you'd need to use -a 1, but -r does not work in -a 1. What you'd probably want to do to crack passwords like this is use combinator.bin to join the two wordlists, then perform a hybrid attack:

Code:

hashcat-utils/combinator.bin dictionary1.txt dictionary2.txt >dictionary1_2.txt
oclhashcat64 hash.txt -a 6 dictionary1_2.txt ?d?d?d

[mokahless]

Thanks epixoip. Looks like I was misunderstanding the ability to add rules alongside a combinator attack.

Might anyone be able to point me to an English dictionary file with between 3,000 and 10,000 common English words? My list is 300,000 and that's too much to handle. Since both my words are extremely common, it should be good enough. I've found some fairly short ones but to be reasonable, I'm using the words "friendly" and "jade" as a guideline to see if it's good enough for longer-term use. So if anyone has any suggestions, I'd appreciate it. It's funny because I'm looking for a small wordlist of dictionary words and all I can find are small lists of common passwords or large dictionaries. I've come close but not quite.

Edit: for those interested, I managed to find a list close to what I was looking for here: http://www.talkenglish.com/Vocabulary/en...ulary.aspx

Just have to copy paste the whole thing into a text file then use cut to remove the number counts, bracketed words, tabs etc.

I found another list at 39,214 that had both "friendly" and "jade" and it will be useful but for testing, 98 days at 187kH/s to go through the keyspace is too much. My ~2k list will take almost 8 hours. Not too bad but I wouldn't mind a slightly larger list in between the two at 3k-9k words (apparently the average educated person knows 8k English words).

[epixoip]

You can use rules with the combinator attack, but only single rules with -j/-k.

As far as a small dictionary of common words goes, have a look at https://en.wiktionary.org/wiki/Wiktionar...ts#English