recover cracked gmail

[Fishfinger/wCus]

Hi,

hope it´s ok to ask this here.

Long story short:
fathers ex-girlfriend got his gmail password
swapped his security mail and phone number with hers.
GMX offers recovery with passport, we got the account back.
Google doesnt offer something like this.
They are like "use your recovery mail or phone number to get your password back"
"We cant use it, she changed it"
"Sorry, no such help for freemail. create a new account"

We knew the mail-adress she used as new recovery mail (her personal adress with clearname in it) and the phone number (her personal mobil phone) but google still offers no help.

We need this account back, there are mail and calender information we have to get back.

A few weeks ago, she gave him a "hint" and wrote: "your password has to be asshole"birthday"."

So I googled and found hashcat.

Is it possible, to create a wordlist with the suspected mainword "asshole", vary it with numbers etc. and go for account recovery?

Thank you,
Fishfinger

[NoReply]

Well, first of all, hashcat does not support any kind of online password guessing. That means you will have to type any generated password by hand.

It is possible to generate word lists though by using the --stdout parameter and piping the generated data into a file. On the other hand you could use something like python for this purpose, if you are familiar with programming.

For your case, it you could use a mask attack like this: hashcat --stdout -a 3 asshole?d?d?d?d
Or use a specific rule file, that only appends valid date combinations.

I don't think that this will help you though, as I would expect Google to block you from guessing the password after too many failed attempts. Your best bet is probably to factor in the known DOBs you got available.

[Mem5]

hashcat can create wordlist but not the best tool for that (not its primary goal)
hashcat cannot bruteforce gmail/hotmail etc.

[Fishfinger/wCus]

Ok, good to know.
I am still reading into stuff and try to understand what possibilities I have.


@NoReply

Your best bet is probably to factor in the known DOBs you got available.

DoB you mean Date of Birth I guess?
And yes, google give back false positive when trying.