Using BT5 Crunch to Generate Wordlists

INTRO:

Crunch is a tool for creating bruteforce wordlists which can be used to audit password strength.
The size of these wordlists is not to be underestimated, however crunch can make use of patterns to reduce wordlist sizes, can compress output files in various formats and (since v2.6) now includes a message advising the size of the wordlist that will be created, giving you a 3 second window to stop the creation should the size be too large for your intended use.

The full range of options is as follows:
-b Maximum bytes to write per file, so using this option the wordlist to be created can be split into various sizes such as KB / MB / GB (must be used in combination with "-o START" switch) -c Number of lines to write to output file, must be used together with "-o START" -d Limits the number of consecutive identical characters (crunch v3.2) -e Specifies when crunch should stop early (crunch v3.1) -f Path to the charset.lst file to use, standard location is '/pentest/passwords/crunch/charset.lst to be used in conjunction with the name of the desired charset list, such as 'mixalpha-numeric-space' -i Inverts the output sequence from left-to-right to right-to-left (So instead of aaa, aab, aac, aad etc, output would be aaa baa caa daa) -l When specifying custom patterns with the -t option, the -l switch allows you to identify which of the characters should be taken as a literal character instead of a place holder ( @,%^ ) -o Allows you to specify the file name / location for the output, e.g. /media/flashdrive/wordlist.txt -p Prints permutations of the words or characters provided in the command line. -q Prints permutation of the words or characters found in a specified file -r Resumes from a previous session, exact same syntax to be used followed by -r -s Allows you to specify the starting string for your wordlist. -t Allows you to specify a specific pattern to use. Probably one of the most important functions ! Place holders for fixed character sets are ; @ -- lower case alpha characters , -- upper case alhpa characters % -- numeric characters ^ -- special characters (including space) -u Supresses the output of wordlist size & linecount prior starting wordlist generation. -z Adds support to compress the generation output, supports gzip, bzip & lzma

crunch is available in the BT repositories,
so can download and install on backtrack5 simply by doing:
apt-get update apt-get install crunch

BASIC USAGE AND CHARACTER SETS:

The default installation directory / path for crunch in backtrack 5 is
/pentest/passwords/crunch/

All the below examples are based on being in the crunch directory /pentest/passwords/crunch/
To run crunch from outside of crunch’s own directory use:
/pentest/passwords/crunch/crunch [min length] [max length] [ character set] [options]
example from root directory:
/pentest/passwords/crunch/crunch 8 8 abc + + !\@# -t TEST^%,@ -o test.txt

-Image Courtesy of the internet.

Basic usage is as follows to print to screen
./crunch [min length] [max length] [character set] [options]
To write to file use the -o switch:
./crunch [min length] [max length] [character set] [options] -o filename.txt
If no character set is defined, then crunch will default to using the lower case alpha character set:
./crunch 4 4
Certain characters will need escaping with a backslash :
./crunch 6 6 ABC\!\@\#\$

USING FIXED CHARSETS TO CREATE LISTS:

Crunch also comes with fixed character sets in charset.lst which is included in the installation.
(also found in directory /pentest/passwords/crunch/ )

This saves on the typing (and typoes) when dealing with standard character sets.

To use the fixed characters sets, instead of typing in character sets manually in the command line,
you can use the -f switch to specify which character set we want to use ;

To use all characters allowed when creating a passcode:
./crunch 2 4 -f charset.lst mixalpha-numeric-all-space
root@bt:/pentest/passwords/crunch# ./crunch 2 4 -f charset.lst mixalpha-numeric-all-space -o words.txt Crunch will now generate the following amount of data: 410709700 bytes 391 MB 0 GB 0 TB 0 PB Crunch will now generate the following number of lines: 82317025 35% 71% 100% 100%
The whole process of crunch can be stopped by ^C. Also be careful of using this program, it can make ENORMOUS files that of those sizes can be in TB.

Have fun hacking!

Sail Safe