Using Aircrack-ng with Crunch
Crunch is an easy-to-use password generator
and interacts with aircrack-ng in the same way as JtR.
Given a pattern and a character set or words,
Crunch is able to generate all possible combinations.
The crunch command only requires us to specify the first two parameters,
namely the minimum length and maximum length of the password.
WPA requires passphrases between eight and 63 characters.
Let’s limit our search a bit and create a wordlist
that will give us all possible combinations
for a passphrase of eight to nine lowercase characters.
The output indicates the generated wordlist
will take 51 Tera bytes of storage,
which clearly isn’t practical.
We’ll need to find a way to refine the wordlist.
One thing we can do is limit the possible characters.
We’ll use crunch to create a wordlist
that only has the characters a, b, c, 1, 2, and 3.
To do this, let’s add abc123 to our command,
and generate a much smaller wordlist.
The generated wordlist is now a much more manageable 110 MB.
Crunch also allows us to specify a pattern
with the -t option with or without a character set.
Different symbols in the pattern define the type of character to use.
Using the pattern option, let’s generate a wordlist
that can crack our WPA 4-way handshake.
This crunch command generates 11 character passwords,
with a pattern of the word password,
and appended with three numbers.
Another way to achieve the same result is to use the pattern option
and a defined character set of numbers.
The -p option generates unique words
from a character set or a set of whole words.
Although we still need to provide the minimum and maximum length,
those numbers are ignored.
Let’s use crunch with -p and multiple values
to generate a list of unique words.
We can also combine the -t and -p options to further refine the wordlist.
In this example, the pattern, “ddd%%”,
takes the words defined by -p,
and assigns them to each d variable.
Any alphanumeric character can be assigned as the variable.
Then the percent symbols,
append two digits to the resultant word.
The minimum and maximum length values must match the pattern, however.
In the output, we find that Crunch added two integers to the end of each word.
If we had used @ symbols instead of percents,
crunch would have added lower case letters.
We have a great deal of freedom when using the -t option.
Next, let’s take a defined character set
and assign them in the pattern with the @ symbol.
This creates a word made up of five elements,
in a pattern of three variables,
from the character set,
and two characters, from the defined set,
as displayed in the output.
Some of these wordlists require a great deal of storage space
but generating them requires very little CPU power.
There is very little value in storing these large wordlists
since aircrack-ng can process wordlists received from standard input.
Similar to JtR, we can pipe Crunch’s generated wordlist into aircrack-ng.
Note that this command can be replaced by any other crunch command
as long as it outputs the wordlist to the screen.
Crunch very rapidly cracked the password by creating a focused wordlist.