Instructor: From the previous lectures, 2 2
we learned that when it comes to WPA and WPA2, 3 3
the only packets that contain some information 4 4
that can help us with cracking the key, 5 5
are the handshake packets. 6 6
And in the last lecture, we learned how 7 7
to capture the handshake and store it in a file. 8 8
Now the handshake does not contain any information 9 9
that can help us to recover or recalculate the WPA key. 10 10
The information in it can only be used 11 11
to check whether a password is valid or not. 12 12
Therefore, what we're going to do is to create a wordlist, 13 13
which is basically a big text file 14 14
that contains a large number of passwords. 15 15
Then go through this file, 16 16
go through the passwords one by one, 17 17
and use them with the handshake 18 18
in order to check whether this password is valid or not. 19 19
You can actually download ready wordlists from the internet, 20 20
but in this lecture, I wanna teach you 21 21
how to create your own wordlist, 22 22
and in the next lecture I'm going to explain to you 23 23
how the wordlist and the handshake are used 24 24
in order to recover the password, 25 25
and we'll see how to do that in practice. 26 26
So, in this lecture we're gonna learn 27 27
how you create your own wordlist using a tool called Crunch. 28 28
This is a really handy skill to have under your belt 29 29
if you want to be a penetration tester, 30 30
because you're gonna face a lot of scenarios 31 31
where a wordlist attack can become very handy. 32 32
So, using the tool is very simple. 33 33
All you have to do is just put the name of the tool, 34 34
and then you specify the minimum number of characters 35 35
for the passwords to be generated. 36 36
Then we're gonna specify the maximum number of characters 37 37
for the password. 38 38
Then you specify the characters 39 39
that you want to generate passwords from. 40 40
For example, you can put all lowercase characters, 41 41
all uppercase, you can put numbers, digits, 42 42
or you can just specify a smaller number 43 43
to make the wordlist smaller. 44 44
You can also use the option T, which is an optional, 45 45
to give a pattern. 46 46
So for example, let's say that you are looking at the person 47 47
while they were typing their password, 48 48
and you seen that the password would start with an A. 49 49
So you can tell Crunch that the password 50 50
will start with an A, 51 51
and then give me all possible combination of passwords 52 52
that start with an A. 53 53
And after that, we use the -o option 54 54
to specify the file name where the passwords 55 55
are gonna be stored. 56 56
So we have a small, little example here 57 57
that'll generate a list of passwords 58 58
that start from six characters to eight characters, 59 59
and contain these characters right here. 60 60
So it's gonna create combinations of 123abc, 61 61
and a dollar sign. 62 62
And it's gonna store it in a file called wordlist. 63 63
And these passwords are gonna start with an A, 64 64
and end with a B. 65 65
And it will generate passwords based 66 66
on all possible combinations between the A and the B, 67 67
so all of the generated passwords will always start with A, 68 68
and end with B. 69 69
So let's have an example of the tool. 70 70
Now the tool actually have a lot of options, 71 71
other than what we've seen so far. 72 72
So if you just type in man, crunch, 73 73
you'll see all the options that you can set, 74 74
and you'll see detailed description 75 75
about all of these options. 76 76
So it's actually really, really good. 77 77
You can go ahead and spend some time 78 78
to get familiar with the tool. 79 79
Now I'm gonna show you the example, 80 80
and based on the example, you'll be able to run 81 81
all of these commands. 82 82
But, if you want to run or create some advanced wordlists, 83 83
then I highly recommend that you go over this. 84 84
One of the really cool options that I wanna highlight 85 85
is the -p option. 86 86
The -p option tells Crunch to generate passwords 87 87
that don't have repeating characters. 88 88
For example, when you specify all lowercase characters, 89 89
you specify abcd, it'll start by generating passwords made 90 90
of aaaaaaa, and then abbbbb, and all of that. 91 91
So, when you do this, Crunch will actually ignore these type 92 92
of passwords, and it'll only create passwords 93 93
that don't have any repeating characters. 94 94
And that'll reduce the size of the wordlist 95 95
from the number of characters to the power of the length, 96 96
to the number of characters factorial. 97 97
If you scroll down you'll actually see more examples 98 98
of commands and the type of wordlists 99 99
that will be created. 100 100
So, again, you can have a look on these, 101 101
and get yourself familiar with. 102 102
Once you're done looking at the man, 103 103
you can just press Q, and you'll be out of it. 104 104
And we're gonna run our command here, 105 105
so we're gonna use Crunch. 106 106
And I want to generate passwords 107 107
of minimum of six characters, 108 108
and maximum of eight characters. 109 109
And I want them to contain combinations of abc. 110 110
And let's say the digits 1-2. 111 111
Now in here you can actually keep listing things. 112 112
You can list characters, you can list uppercase characters, 113 113
or even symbols if you wanted to. 114 114
Once you're done with listing the characters, 115 115
we're gonna specify the file to save it to. 116 116
And we're gonna save it in a file called test.txt. 117 117
So the command is very simple. 118 118
It's crunch, minimum length of the password, 119 119
the maximum length of the password, 120 120
followed by the characters that we want to use 121 121
to generate passwords from, and then O 122 122
to the file that the passwords are gonna be stored in. 123 123
I'm gonna hit Enter. 124 124
And as you can see, now it's telling us 125 125
that it generated 448,000 passwords, approximately. 126 126
And they're all stored in a file called test.txt. 127 127
Now, the size of the file is four megabytes. 128 128
And now I can open this file by doing cat, test.txt. 129 129
And as you can see, now we can see all the passwords 130 130
that have been generated. 131 131
I'm gonna Ctrl+C out of it, 'cause it's a huge file. 132 132
And as you can see, it actually contains 133 133
all possible combinations of abc12. 134 134
I also want to show you an example of using the -t option. 135 135
So, I'm gonna set this to only six to six, 136 136
so it's only six characters. 137 137
And we're gonna use the -t option, 138 138
which is the pattern option. 139 139
And I'm gonna tell it that I want the password 140 140
to always start with an A. 141 141
And then I want you to fill all possible combinations 142 142
of characters between the A, and the B. 143 143
So I want passwords that start with an A, 144 144
and end with a B. 145 145
And in the middle, at the at sign, 146 146
you can fill all possible combinations of abc12. 147 147
Gonna hit Enter. 148 148
As you can see now, the number of passwords is much less, 149 149
it's only 625 passwords, because I've narrowed down 150 150
the possibilities of passwords. 151 151
Again, if I do cat, test.txt, 152 152
you'll see that I have all the passwords right here. 153 153
So this is it, tool is really useful. 154 154
Can be used in many scenarios. 155 155
I highly recommend that you spend some time with it, 156 156
and also have a look on some 157 157
of the existing wordlists out there on the internet.