Using Aircrack-ng with RSMangler
RSMangler is a Ruby script that takes words
as input and modifies them in multiple ways,
such as changing case, switching order, using “leetspeak”, adding numbers,
and so on in order to create a non-repeating wordlist.
From a few words, RSMangler can create a giant wordlist for password cracking
that can either be piped to other tools or saved to a file.
All of RSMangler’s word manipulation options are on by default,
but we can add parameters to the command line to turn individual options off.
To demonstrate RSManlger, we first create a text file with “dog”, “cat”, and “bird”.
Next we’ll process that file with the rsmangler command and the --file option.
By default, the RSMangler results are output to the screen.
To save the RSMangler results to a file, we use the --output option.
A set of three words generates about 6,000 passwords,
four words generates about 23,000 passwords,
and five words generates about 125,000 passwords.
We need to take care
to ensure the wordlist we begin with is a reasonable size.
RSMangler caches the results in memory in order to remove duplicates
before writing to standard output and displaying them on the screen.
When using three or four words,
this process doesn’t take very long and CPU usage is negligible.
However, with each additional word, the time taken and the memory used
to eliminate duplicates increases exponentially.
The allow-duplicates option disables the duplicate check,
and unless your application cannot handle duplicates, this is preferable.
With five words, RSMangler generates about 300 duplicates,
or 0.25% of the total, so the tradeoff is well worth it.
Similar to how we piped JtR and Crunch output to aircrack-ng,
we’ll pipe a file into RSMangler with the file option
with a dash in place of the file name.
Using min and max options, we limit the length
of the RSMangler words to between 12 and 13 characters.
Limiting the word size results in approximately 1500 passwords.
This amount varies depending on the number of words in the wordlist,
as well as the length of each item.
Just like we did with JtR and Crunch,
we can pipe the words generated by rsmangler,
into aircrack-ng to crack a 4-way handshake in a demonstration pcap file.
Note that the command can be replaced by any other RSMangler command
as long as the output option,
isn’t used since the wordlist isn’t directed to an output file.
This cracks our passphrase.