Original subtitles

1 1

From the previous lectures, 2

2

we learned that when it comes to WPA and WPA2, 3

3

the only packets that contain some information 4

4

that can help us with cracking the key, 5

5

are the handshake packets. 6

6

And in the last lecture, we learned how 7

7

to capture the handshake and store it in a file. 8

8

Now the handshake does not contain any information 9

9

that can help us to recover or recalculate the WPA key. 10

10

The information in it can only be used 11

11

to check whether a password is valid or not. 12

12

Therefore, what we're going to do is to create a wordlist, 13

13

which is basically a big text file 14

14

that contains a large number of passwords. 15

15

Then go through this file, 16

16

go through the passwords one by one, 17

17

and use them with the handshake 18

18

in order to check whether this password is valid or not. 19

19

You can actually download ready wordlists from the internet, 20

20

but in this lecture, I wanna teach you 21

21

how to create your own wordlist, 22

22

and in the next lecture I'm going to explain to you 23

23

how the wordlist and the handshake are used 24

24

in order to recover the password, 25

25

and we'll see how to do that in practice. 26

26

So, in this lecture we're gonna learn 27

27

how you create your own wordlist using a tool called Crunch. 28

28

This is a really handy skill to have under your belt 29

29

if you want to be a penetration tester, 30

30

because you're gonna face a lot of scenarios 31

31

where a wordlist attack can become very handy. 32

32

So, using the tool is very simple. 33

33

All you have to do is just put the name of the tool, 34

34

and then you specify the minimum number of characters 35

35

for the passwords to be generated. 36

36

Then we're gonna specify the maximum number of characters 37

37

for the password. 38

38

Then you specify the characters 39

39

that you want to generate passwords from. 40

40

For example, you can put all lowercase characters, 41

41

all uppercase, you can put numbers, digits, 42

42

or you can just specify a smaller number 43

43

to make the wordlist smaller. 44

44

You can also use the option T, which is an optional, 45

45

to give a pattern. 46

46

So for example, let's say that you are looking at the person 47

47

while they were typing their password, 48

48

and you seen that the password would start with an A. 49

49

So you can tell Crunch that the password 50

50

will start with an A, 51

51

and then give me all possible combination of passwords 52

52

that start with an A. 53

53

And after that, we use the -o option 54

54

to specify the file name where the passwords 55

55

are gonna be stored. 56

56

So we have a small, little example here 57

57

that'll generate a list of passwords 58

58

that start from six characters to eight characters, 59

59

and contain these characters right here. 60

60

So it's gonna create combinations of 123abc, 61

61

and a dollar sign. 62

62

And it's gonna store it in a file called wordlist. 63

63

And these passwords are gonna start with an A, 64

64

and end with a B. 65

65

And it will generate passwords based 66

66

on all possible combinations between the A and the B, 67

67

so all of the generated passwords will always start with A, 68

68

and end with B. 69

69

So let's have an example of the tool. 70

70

Now the tool actually have a lot of options, 71

71

other than what we've seen so far. 72

72

So if you just type in man, crunch, 73

73

you'll see all the options that you can set, 74

74

and you'll see detailed description 75

75

about all of these options. 76

76

So it's actually really, really good. 77

77

You can go ahead and spend some time 78

78

to get familiar with the tool. 79

79

Now I'm gonna show you the example, 80

80

and based on the example, you'll be able to run 81

81

all of these commands. 82

82

But, if you want to run or create some advanced wordlists, 83

83

then I highly recommend that you go over this. 84

84

One of the really cool options that I wanna highlight 85

85

is the -p option. 86

86

The -p option tells Crunch to generate passwords 87

87

that don't have repeating characters. 88

88

For example, when you specify all lowercase characters, 89

89

you specify abcd, it'll start by generating passwords made 90

90

of aaaaaaa, and then abbbbb, and all of that. 91

91

So, when you do this, Crunch will actually ignore these type 92

92

of passwords, and it'll only create passwords 93

93

that don't have any repeating characters. 94

94

And that'll reduce the size of the wordlist 95

95

from the number of characters to the power of the length, 96

96

to the number of characters factorial. 97

97

If you scroll down you'll actually see more examples 98

98

of commands and the type of wordlists 99

99

that will be created. 100

100

So, again, you can have a look on these, 101

101

and get yourself familiar with. 102

102

Once you're done looking at the man, 103

103

you can just press Q, and you'll be out of it. 104

104

And we're gonna run our command here, 105

105

so we're gonna use Crunch. 106

106

And I want to generate passwords 107

107

of minimum of six characters, 108

108

and maximum of eight characters. 109

109

And I want them to contain combinations of abc. 110

110

And let's say the digits 1-2. 111

111

Now in here you can actually keep listing things. 112

112

You can list characters, you can list uppercase characters, 113

113

or even symbols if you wanted to. 114

114

Once you're done with listing the characters, 115

115

we're gonna specify the file to save it to. 116

116

And we're gonna save it in a file called test.txt. 117

117

So the command is very simple. 118

118

It's crunch, minimum length of the password, 119

119

the maximum length of the password, 120

120

followed by the characters that we want to use 121

121

to generate passwords from, and then O 122

122

to the file that the passwords are gonna be stored in. 123

123

I'm gonna hit Enter. 124

124

And as you can see, now it's telling us 125

125

that it generated 448,000 passwords, approximately. 126

126

And they're all stored in a file called test.txt. 127

127

Now, the size of the file is four megabytes. 128

128

And now I can open this file by doing cat, test.txt. 129

129

And as you can see, now we can see all the passwords 130

130

that have been generated. 131

131

I'm gonna Ctrl+C out of it, 'cause it's a huge file. 132

132

And as you can see, it actually contains 133

133

all possible combinations of abc12. 134

134

I also want to show you an example of using the -t option. 135

135

So, I'm gonna set this to only six to six, 136

136

so it's only six characters. 137

137

And we're gonna use the -t option, 138

138

which is the pattern option. 139

139

And I'm gonna tell it that I want the password 140

140

to always start with an A. 141

141

And then I want you to fill all possible combinations 142

142

of characters between the A, and the B. 143

143

So I want passwords that start with an A, 144

144

and end with a B. 145

145

And in the middle, at the at sign, 146

146

you can fill all possible combinations of abc12. 147

147

Gonna hit Enter. 148

148

As you can see now, the number of passwords is much less, 149

149

it's only 625 passwords, because I've narrowed down 150

150

the possibilities of passwords. 151

151

Again, if I do cat, test.txt, 152

152

you'll see that I have all the passwords right here. 153

153

So this is it, tool is really useful. 154

154

Can be used in many scenarios. 155

155

I highly recommend that you spend some time with it, 156

156

and also have a look on some 157

157

of the existing wordlists out there on the internet.