Hello everybody and welcome back to another lecture in the wireless penetration testing section.
Now in the previous lectures I showed you how to capture the former handshake and how to brute force
it with your view and Jeep you will use to tools called Air crack and hash and we used some of the already
installed loyalists basically in clinics.
But now let's say you want to create some of your own world lists or you want to target a specific person
that you know and you basically know something about them and you wanted to create for example more
data that could help you brute force it could force the password faster.
Now there is a simple program in clinics which comes pre installed.
It is called crunch.
So let me just show you let me just to leave you as we do not need it anymore.
The crunch.
Let's open the manual for crunch.
It is basically a program that is used to create the world list as we can see right here.
Crunch can create a board list based on criteria you specify the output form a crunch can be sent to
the screen while a file or to another program which is really important.
This paper here to another program and I will show you why in just a second but before we begin let
me just show you that it has a bunch of options that you basically if you want to you can learn.
I don't know most of these options.
I basically just open manual and then I specify what I want to make.
Now the simplest use of this would be to let me just with this would be pulled for example type here
crunch and the syntax would be to specify the minimal letters or numbers that you want in the word and
the maximum letters or numbers that you want in the world.
So for example let's say I want to make five sit all the words that I buy I basically want to make a
file with the words that have six characters.
So if I just I right typically this you will notice that it will start printing all of these words right
here that are consistent from six characters and it will basically go to all of the all of the combinations.
There are for these six character words now that will take a long time so let's just close this.
Let me just show you before it starts once again that right here it says crunch will now generate the
following amount of data and you can see how many bytes it will create the size of the file will be
two thousand megabytes or basically two gigabytes and the number of the of the basically passwords or
lines that you would have in that file is this one which is I believe three hundred and eight million
close to 309 million which is a lot it would take a lot a lot longer.
The normal pull up I'm going to take a lot of time to create this password list and it would also take
a lot of time to complete this password rest in a brute forcing especially if use aircraft and your
view and also especially if you use it on a virtual machine as we saw that the speed of where crack
on our cat Linux machine was only 350 passwords per second.
Now imagine running that with running that speed with this password.
It would take you months to finish.
Loretta just the simple use of this password list.
You can also change the numbers.
For example let's say we want to make all the passwords that contain between three and five letters
or characters.
We can see that this is a lot smaller.
It will basically print out all the passwords with three to five characters as we can see it really
fast in the first three character words and the fourth character words.
And now it is onto the five character words which will actually take the most of the the most of the
file.
Let me just see the size of it.
It was 70 megabytes and it has around 20 million passwords right here which is basically somewhere a
little less than the rock you got the password that you will be for just in the Iraqi you that the password
list there are a bunch of passwords that were already I believe hacked before and they were put in that
file as the passwords that were mostly used by other users online.
So those are legit passwords used at some point by some user on some Web site let's say we want to specify
something else in greater detail with crunch.
So let's open manual crunch and let's go to some of the examples that they have right here as we can
see.
Example one.
Crunch 1 2 8.
And it gives you the explanation which is basically crunch will display our list that starts at 8:00
and ends at this easy.
Which means it will create the list of all the words contained and containing between 1 and 8 characters.
The crunch 1 2 6 A B C D E F G will create the port lists and the orders that that contains are words
between 1 and 6 characters that only have these seven characters right here which is ABC D and E F G.
Example 3 would create.
You can.
Let's not create let's not read all of them.
Let's just go down here and see there is anything interesting that we might need.
Size file this is not.
You can also specify the size of the file as we can see right here.
The first three files are 20 megabytes.
These are just bunch of the options that you can specify.
We do not want to actually bother with all of them but you can't specify however but not specify what
is important to you are these characters right here.
Once you specify them let me just find where exactly are they
are they written they all represent saying Ah here they are with the minus this is option that you want
to know or not know that you want to know that it exists the minus command and then these three or four
symbols specify a pattern where the only.
Yeah well we specified a pattern where you have for example a word in that bathroom and all the other
symbols will change as we can see the at symbol insert lowercase letters.
So let's say that someone specified this password.
They know that because the word is actually consisted in the entire password of that wireless network.
So he specifies the at will insert lowercase characters the comma will insert uppercase characters the
percentage sign will insert numbers.
And the upper this upper arrow right here will insert symbols.
Now let me show you.
Let's actually try that.
So we press Q and let's say we type here something like this.
We want the seven word the seven character passwords that basically have let's say lower letters then
the word for example word and then come up for the number I believe it is.
No so let's try to see what it will print.
It only has 300000 passwords.
It wasn't a word.
It was only a comma.
Oh yeah I forgot I specified I forgot to specify the minus three options.
So after that you need to specify minus t option.
And only then you can use this.
And right now it will print all the words as we can see right here.
Now the comma was a capital letter not a number.
As we can see by the last letter here they are all capital then the first two are smaller characters.
They that went to all of the combinations and we can see in the middle there is a word that we specified
it to be their so you can also specify let's say a bigger pass for this.
So let's use the same.
But right now let's use the upper arrow and another upper arrow in here.
What we want to do is minus or not minus.
We want to specify nine letter carrier nine character models.
This will be a lot larger as we can see and we can see that those upper arrows represent symbols.
So we said the the at the end there should be two symbols and there really are no I'm not really sure.
There is a zero at the end of every you can see right here.
Word yo yo.
Let me just check something out.
It's not zero it is no it is zero.
I'm not really sure why is it there but it doesn't really matter as we can see these are the symbols
that we specify at the end and the capital characters and the smaller letter characters.
Now the thing that you need is to write this to file for basically you do not want to just output it
in the terminal like this you want to write it somewhere to a file so you can use it later on.
Now in order to do that basically just type your crunch.
You know for example let's say you want all the five letter words and then crunch it into passwords
not to exceed.
And as you can see it will basically put all of these I believe 11 million or even more.
Yeah around 11 million passwords into these passwords that the far if we had the password to the file
right now you will see all of these five letter passwords stored in their.
So now that we know that you did that you can basically just run a simple error crackdowns does that
and G minus W. And then your password list and then the the file that contains your handshake.
Now I'm not really sure what happened right here.
You see it like is so keen up phone the dates specify something wrong.
Let me just check it once again.
If I run it
just check.
Let me just.
I'm not too sure why isn't it outputting it right here.
So let us use users share more of this common
knowledge skills like you did the extra and let's see.
OK.
So right now it wants to work.
I'm pretty sure it could be because of the passwords that are only five letters long.
It could be something like that.
Not really sure why it doesn't even matter what we will do right now is I will show you how you can
use crunch in order to pipe that into the air crack.
Now by pipe I mean you know produce the output of the crunch command and use it as the input in the
aircraft and therefore you do not need to have any password list and you can use as many passwords as
you want as long as you have time to finish it.
Now in order to do that basically you know once you type a basic command which is crunch three three
this will not write all of these passwords to any file it will only output it.
Right here we want to use that and pipe it to the aircraft programs of the aircraft program reads from
our output right here and uses that in order to compare the hashed password.
Now how we do that we do that simply like this.
So crunch and let's actually try to attack my password or my Wi-Fi.
We know that my password is this one.
This is the password on my wireless network.
And let's actually do an attack on it and pipe it.
So crunch twelve twelve since that has twelve characters I believe.
Let me just count.
Yeah.
It has both characters minus the option.
Let's say for example we know that the that the first four letters for example yeah let's say we only
know the first four letters of the password or let's say the first six letters so it performs faster
so we know that this has the this is a part of the password and what we want to do after that is basically
to specify I believe it was this one for the smaller characters and this one is for the numbers.
Now this will run all this will run all of the all of the combinations with two characters on the two
characters that you just see.
Yeah.
Two smaller characters and four different numbers.
And we want to type that and pipe it.
We could use this command right here or not command this character right here which is the basically
straight line up upward straight line.
And you type here with the program where you want to pipe it.
So we want to fight it.
Pipe it to care crack the dash.
And G minus W and then minus and then the name of your docket file and if you
Yeah I want to show you this as well.
It will say please specify a society or b as say D.
We know that T E SSA D is the name of the virus and the B as say D is the Mac address of the virus.
Now it would be easier for us to specify the E as say D which would be just the name of your wireless.
In my case it is.
It is this one you specify it with minus E command for the SSA D and then you just type here the name
of your virus network.
Basically a simple name that you can check out on your mobile phone.
Once you do that and you have this command right here aircraft minus and G minus W and then minus and
pastes scan and then one another on or any name of the file that you've written and then minus E and
then the name of your pilots network and if you're on this it will give us this uh it will stop running
it and you can see it is basically trying all of the combinations right here as we can see it is using
currently the first letters which is which is a.
And then it is brute forcing it with different numbers.
Now as we can see this will take a lot longer than I thought it would take.
So we will just close it right here if I can't close it
now I'm not really sure why it isn't closing.
Let me just
weird let me just close it like this so we'll close it once again and then we will run it
let me just enlarge this.
You can see it better and that's from the same command.
But right now we do not want to run it with numbers.
Let's say we know the.
For the all of the characters that are consistent in our password and we do not know the numbers that
come after.
So let's see how fast this will take.
It should only put forth the number about
I believe it should have pulled it.
Guess the password but for some reason it didn't.
It went through it let us see.
We can wait for me to finish.
It will take only a few more seconds as it is already on the number six.
If it doesn't find it I'm not sure why it didn't find it
let's just wait for this.
We did find a key.
But why did it say it at the end.
I'm not sure how it could possibly be that the key that the number zero was at the end of the list that
it used.
Not really sure why but we now see that it did find the password.
So our attack was successful.
We were able to pipe the output of cache command into the aircraft command and actually brute force
it.
With this we didn't need any pass for this.
So for example if you wanted to you could use twelve character passwords you use it just like this and
then specified to try all of the twelve character passwords.
But the problem is that this will take thousands and millions and billions of years to finish as passionate
with this speed right here.
So it wouldn't really be smart for you to try to brute force twelve character passwords like this but
if you want to there is an option right here.
It won't work though.
But it is there.
So that will be about it for these crunch command.
We will continue with another tool in the next lecture where I will show you how to make a password
based that could be specifically used for a single person that you might know.
It doesn't have to use only a modest network it can be used to force any account you want from that
person.
And we will do that in the next story though and I hope I see you there by.