Learn to use CRUNCH step by step.

<br /><br /><br /><br />Greetings brother@s.<br /><br />In the world of hacking we have a technique called brute force, viewed favorably by some and unfavorably by others, but this is not the place to debate the quality of the technique, since according to wikipedia brute force is:<br /><br />"The way to recover a key by trying all possible combinations until finding the one that allows access."<br /><br />Very well, to orchestrate this type of attack we will need a file that contains within itself hundreds, thousands and even millions of words to try 1 by 1 until hitting the valid one, these files in good Spanish are called dictionaries and the gringos, so nobody gets confused, call them wordlists (lists of words).<br /><br />Now I want you to imagine that we had to create a dictionary writing all the possible words 1 by 1, it wouldn't make sense nor would it be practical, so there are programs that generate dictionaries automatically simply by specifying some input parameters, among those programs it could be said that the best known is Crunch, an application without a graphical interface that has great flexibility when generating dictionaries/wordlists, there is a lot of documentation about it, but generally 1 or 2 examples about its use are explained, leaving the user to discover the rest, well here at underc0de we are going to give you a complete manual with all the options and practical uses so that no doubt remains, this will be something like a Crunch workshop, so board the crazy ship of knowledge and let's get to it.<br /><br /><br /><br />Crunch is a program that, based on criteria established by the user (input), is capable of generating dictionaries to be used in brute force (output), the result of Crunch can be seen on screen, can be saved to a .txt file or can be sent to another program in real time for its use.<br /><br />Version 1.0 was created by mima_yin (mimayin@ACiiiD.ath.cx) and all later versions were updated and developed by bofh28 ([email protected]) to them all the thanks and respect for such a wonderful tool.<br /><br />The official page is:<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />[/b]<br /><br />LINUX<br /><br />Well in any Linux distro it would be enough to pull up the terminal and type:<br /><br />

sudo apt-get install crunch

<br /><br />Depending on the distribution we could have one package manager or another, so each one could modify the command according to their systems (yum, pacman, aptitude, etc..)<br /><br />Imagining that it is not in the software repositories we could download the tarball and install it ourselves:<br /><br />

git clone http://git.code.sf.net/p/crunch-wordlist/code crunch-wordlist-code<br />cd crunch-wordlist-code;<br />sudo make && sudo make install;

<br /><br />Windows<br /><br />Well the creator has not released an official version for windows users, but here comes the magic of open-source software, and the thing is that a user, better said a female user (maripuri) has compiled version 3.2 of crunch for windows, so many thanks to her for her effort and work, those interested can download the file from here:<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br /><br /><br />Very well brother@s the moment of truth has arrived, the moment has come to undress this wonderful tool and be able to use it efficiently, next we will see its use, from the simplest execution to the most complex.<br /><br />It would be enough to type "crunch" in a terminal to get information:<br /><br /><br /><br />Where we can read clearly the simple way in which we can use it:<br /><br />

<br />Usage: crunch <min> <max> [options]<br />where min and max are numbers

<br /><br />It's as simple as telling it the number of characters we are looking for followed by some option, let's launch it in a basic way to see how it goes, let's try generating all possible combinations for a 4 character word:<br /><br />

crunch 4 4

<br /><br /><br /><br />As seen in the image crunch warns in a very polite way how many lines will be generated and how much space it will take, next I share the first 50 lines of the screen output:<br /><br />

aaaa<br />aaab<br />aaac<br />aaad<br />aaae<br />aaaf<br />aaag<br />aaah<br />aaai<br />aaaj<br />aaak<br />aaal<br />aaam<br />aaan<br />aaao<br />aaap<br />aaaq<br />aaar<br />aaas<br />aaat<br />aaau<br />aaav<br />aaaw<br />aaax<br />aaay<br />aaaz<br />aaba<br />aabb<br />aabc<br />aabd<br />aabe<br />aabf<br />aabg<br />aabh<br />aabi<br />aabj<br />aabk<br />aabl<br />aabm<br />aabn<br />aabo<br />aabp<br />aabq<br />aabr<br />aabs<br />aabt<br />aabu<br />aabv<br />aabw<br />aabx

<br /><br />Let's analyze this for a few seconds...<br /><br />We have that crunch has generated all possible combinations for a 4 character word, but do you notice any particularity?<br /><br />No numbers, symbols, uppercase or blank spaces have been used. The reason is explained below:<br /><br />Crunch uses a variable called charset (character setting) and it's like the set of characters that will be used for the generation of the dictionary/wordlist, by default the charset is lalpha (lower alphabet) but what if we try to configure another charset.<br /><br />

crunch 4 4 -f .charset.lst numeric 

<br /><br />As always, when pressing enter crunch will tell us how many lines and how much space will be used, let's analyze the first 50 lines:<br /><br />

0000<br />0001<br />0002<br />0003<br />0004<br />0005<br />0006<br />0007<br />0008<br />0009<br />0010<br />0011<br />0012<br />0013<br />0014<br />0015<br />0016<br />0017<br />0018<br />0019<br />0020<br />0021<br />0022<br />0023<br />0024<br />0025<br />0026<br />0027<br />0028<br />0029<br />0030<br />0031<br />0032<br />0033<br />0034<br />0035<br />0036<br />0037<br />0038<br />0039<br />0040<br />0041<br />0042<br />0043<br />0044<br />0045<br />0046<br />0047<br />0048<br />0049

<br /><br />Everything went well, but now we notice a small difference, and it's that it only generated numbers, but that's exactly what we wanted right? And how have we achieved it well with the -f option and done!! <br /><br />This option tells it where to look for the variables file, that is, where all the charsets are preset, meaning we must specify the path to the file as well as our selection within it, in my case I have charset.lst in my home directory, so I don't specify a path to it. <br /><br />How many charsets can we choose besides lalpha and numeric?<br /><br />See for yourselves<br /><br />

# charset configuration file for winrtgen v1.2 by Massimiliano Montoro ([email protected])<br /># compatible with rainbowcrack 1.1 and later by Zhu Shuanglei <[email protected]><br /><br /><br />hex-lower                     = [0123456789abcdef]<br />hex-upper                     = [0123456789ABCDEF]<br /><br />numeric                       = [0123456789]<br />numeric-space                 = [0123456789 ]<br /><br />symbols14                     = [!@#$%^&*()-_+=]<br />symbols14-space               = [!@#$%^&*()-_+= ]<br /><br />symbols-all                   = [!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/]<br />symbols-all-space             = [!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ]<br /><br />ualpha                        = [ABCDEFGHIJKLMNOPQRSTUVWXYZ]<br />ualpha-space                  = [ABCDEFGHIJKLMNOPQRSTUVWXYZ ]<br />ualpha-numeric                = [ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]<br />ualpha-numeric-space          = [ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 ]<br />ualpha-numeric-symbol14       = [ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=]<br />ualpha-numeric-symbol14-space = [ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+= ]<br />ualpha-numeric-all            = [ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/]<br />ualpha-numeric-all-space      = [ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ]<br /><br />lalpha                        = [abcdefghijklmnopqrstuvwxyz]<br />lalpha-space                  = [abcdefghijklmnopqrstuvwxyz ]<br />lalpha-numeric                = [abcdefghijklmnopqrstuvwxyz0123456789]<br />lalpha-numeric-space          = [abcdefghijklmnopqrstuvwxyz0123456789 ]<br />lalpha-numeric-symbol14       = [abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-_+=]<br />lalpha-numeric-symbol14-space = [abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-_+= ]<br />lalpha-numeric-all 	      = [abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/]<br />lalpha-numeric-all-space      = [abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ]<br /><br />mixalpha                   = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ]<br />mixalpha-space             = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ ]<br />mixalpha-numeric           = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]<br />mixalpha-numeric-space     = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 ]<br />mixalpha-numeric-symbol14  = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=]<br />mixalpha-numeric-symbol14-space = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+= ]<br />mixalpha-numeric-all       = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/]<br />mixalpha-numeric-all-space = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ]<br /><br />#########################################################################################<br />#                 SWEDISH CHAR-SUPPORT                                                  # #########################################################################################<br /><br />#########################<br /># Uppercase             #<br />#########################<br />ualpha-sv                        = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ]<br />ualpha-space-sv                  = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ ]<br />ualpha-numeric-sv                = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789]<br />ualpha-numeric-space-sv          = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789 ]<br />ualpha-numeric-symbol14-sv       = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+=]<br />ualpha-numeric-symbol14-space-sv = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+= ]<br />ualpha-numeric-all-sv            = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/]<br />ualpha-numeric-all-space-sv      = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ]<br /><br />#########################<br /># Lowercase             #<br />#########################<br />lalpha-sv                        = [abcdefghijklmnopqrstuvwxyzåäö]<br />lalpha-space-sv                  = [abcdefghijklmnopqrstuvwxyzåäö ]<br />lalpha-numeric-sv                = [abcdefghijklmnopqrstuvwxyzåäö0123456789]<br />lalpha-numeric-space-sv          = [abcdefghijklmnopqrstuvwxyzåäö0123456789 ]<br />lalpha-numeric-symbol14-sv       = [abcdefghijklmnopqrstuvwxyzåäö0123456789!@#$%^&*()-_+=]<br />lalpha-numeric-symbol14-space-sv = [abcdefghijklmnopqrstuvwxyzåäö0123456789!@#$%^&*()-_+= ]<br />lalpha-numeric-all-sv            = [abcdefghijklmnopqrstuvwxyzåäö0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/]<br />lalpha-numeric-all-space-sv      = [abcdefghijklmnopqrstuvwxyzåäö0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ]<br /><br />#########################<br /># Mixcase               #<br />#########################<br />mixalpha-sv                   = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ]<br />mixalpha-space-sv             = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ ]<br />mixalpha-numeric-sv           = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789]<br />mixalpha-numeric-space-sv     = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789 ]<br />mixalpha-numeric-symbol14-sv  = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+=]<br />mixalpha-numeric-symbol14-space-sv = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+= ]<br />mixalpha-numeric-all-sv       = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/]<br />mixalpha-numeric-all-space-sv = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ]<br /><br />

<br /><br />If you don't want to specify any charset you can simply pass to crunch which characters you want to use in the generation, for example:<br /><br />

crunch 4 4 ab12

<br /><br /><br /><br />And the output would be:<br /><br />

aaaa<br />aaab<br />aaa1<br />aaa2<br />aaba<br />aabb<br />aab1<br />aab2<br />aa1a<br />aa1b<br />aa11<br />aa12<br />aa2a<br />aa2b<br />aa21<br />aa22<br />abaa<br />abab<br />aba1<br />aba2<br />abba<br />abbb<br />abb1<br />abb2<br />ab1a<br />ab1b<br />ab11<br />ab12<br />ab2a<br />ab2b<br />ab21<br />ab22<br />a1aa<br />a1ab<br />a1a1<br />a1a2<br />a1ba<br />a1bb<br />a1b1<br />a1b2<br />a11a<br />a11b<br />a111<br />a112<br />a12a<br />a12b<br />a121<br />a122<br />a2aa<br />a2ab<br />a2a1<br />a2a2<br />a2ba<br />a2bb<br />a2b1<br />a2b2<br />a21a<br />a21b<br />a211<br />a212<br />a22a<br />a22b<br />a221<br />a222<br />baaa<br />baab<br />baa1<br />baa2<br />baba

<br /><br />You are starting to understand the sense of the word "Flexibility" to refer to crunch, well let's continue ahead learning more tricks for this wonderful tool.<br /><br />[/b][/u]<br /><br />Up to now we have learned to use crunch at the basic level, that is we only know how to generate dictionaries specifying the size and the set of characters to be used, and many will think that is all the magic of generating dictionaries and the truth is that they are far from it, follow me and we'll see what other things we can do.<br /><br />Do you remember that hacker movie in which the star looks at the keyboard of the system administrator and manages to see the key typed on the keyboard? Well in real life maybe it's not so easy to see the whole key typed and we only manage to remember part of it and maybe its size (yes its size, I usually count the keystrokes on the keyboard so I get an idea of the size) well let's suppose we want to generate a key that starts with "Und......" but we don't know the rest, well we could tell crunch:<br /><br />

crunch 9 9 -t und@@@@@@<br />

<br /><br />And this will generate:<br /><br />

undaaoerv<br />undaaoerw<br />undaaoerx<br />undaaoery<br />undaaoerz<br />undaaoesa<br />undaaoesb<br />undaaoesc<br />undaaoesd<br />undaaoese<br />undaaoesf<br />undaaoesg<br />undaaoesh<br />undaaoesi<br />undaaoesj<br />undaaoesk<br />undaaoesl<br />undaaoesm<br />undaaoesn<br />undaaoeso<br />undaaoesp<br />undaaoesq<br />undaaoesr<br />undaaoess<br />undaaoest<br />undaaoesu<br />undaaoesv<br />undaaoesw<br />undaaoesx<br />undaaoesy<br />undaaoesz<br />undaaoeta<br />undaaoetb<br />undaaoetc<br />undaaoetd<br />undaaoete<br />undaaoetf<br />undaaoetg<br />undaaoeth<br />undaaoeti<br />undaaoetj<br />undaaoetk<br />undaaoetl<br />undaaoetm<br />undaaoetn<br />undaaoeto<br />undaaoetp<br />undaaoetq<br />undaaoetr<br />undaaoets<br />undaaoett<br />undaaoetu<br />undaaoetv<br />undaaoetw<br />undaaoetx<br />undaaoety<br />undaaoetz<br />undaaoeua<br />undaaoeub<br />undaaoeuc<br />undaaoeud<br />undaaoeue<br />undaaoeuf<br />undaaoeug<br />undaaoeuh<br />undaaoeui<br />undaaoeuj<br />undaaoeuk<br />undaaoeul<br />undaaoeum<br />undaaoeun<br />undaaoeuo<br />undaaoeup<br />undaaoeuq<br />undaaoeur<br />undaaoeus<br />undaaoeut<br />undaaoeuu<br />undaaoeuv<br />undaaoeuw<br />undaaoeux<br />undaaoeuy<br />undaaoeuz<br />undaaoeva<br />undaaoevb<br />undaaoevc<br />undaaoevd<br />undaaoeve<br />undaaoevf<br />undaaoevg<br />undaaoevh<br />

<br /><br />And if we notice crunch has generated words without modifying the first 3 characters, so if the keyword is "undercode" it will eventually be generated, but what would happen if the site admin wanted to complicate it and put "underc0de" as password? well we can do it in two ways, one simple and the other a bit more complex, for the complex way we could do it by specifying an alphanumeric charset writing:<br /><br />

crunch 9 9 -f .charset.lst lalpha-numeric -t und@@@@@@

<br /><br />or well we could specify the characters we want to use:<br /><br />

crunch 9 9 abcefghijklmnopqrstuwxyz1234567890 -t und@@@@@@<br />

<br /><br />With both commands we would have the same result, they are simply two ways of doing the same thing<br /><br />

undaaaz1u<br />undaaaz1v<br />undaaaz1w<br />undaaaz1x<br />undaaaz1y<br />undaaaz1z<br />undaaaz10<br />undaaaz11<br />undaaaz12<br />undaaaz13<br />undaaaz14<br />undaaaz15<br />undaaaz16<br />undaaaz17<br />undaaaz18<br />undaaaz19<br />undaaaz2a<br />undaaaz2b<br />undaaaz2c<br />undaaaz2d<br />undaaaz2e<br />undaaaz2f<br />undaaaz2g<br />undaaaz2h<br />undaaaz2i<br />undaaaz2j<br />undaaaz2k<br />undaaaz2l<br />undaaaz2m<br />undaaaz2n<br />undaaaz2o<br />undaaaz2p<br />undaaaz2q<br />undaaaz2r<br />undaaaz2s<br />undaaaz2t<br />undaaaz2u<br />undaaaz2v<br />undaaaz2w<br />undaaaz2x<br />undaaaz2y<br />undaaaz2z<br />undaaaz20<br />undaaaz21<br />undaaaz22<br />undaaaz23<br />undaaaz24<br />undaaaz25<br />undaaaz26<br />undaaaz27<br />undaaaz28<br />undaaaz29<br />undaaaz3a<br />undaaaz3b<br />undaaaz3c<br />undaaaz3d<br />undaaaz3e<br />undaaaz3f<br />undaaaz3g<br />undaaaz3h<br />undaaaz3i<br />undaaaz3j<br />undaaaz3k<br />undaaaz3l<br />undaaaz3m<br />undaaaz3n<br />undaaaz3o<br />undaaaz3p<br />undaaaz3q<br />undaaaz3r<br />undaaaz3s<br />undaaaz3t<br />undaaaz3u<br />undaaaz3v<br />undaaaz3w<br />undaaaz3x<br />undaaaz3y<br />undaaaz3z<br />undaaaz30<br />undaaaz31<br />undaaaz32<br />undaaaz33<br />undaaaz34<br />undaaaz35<br />undaaaz36<br />undaaaz37<br />undaaaz38<br />undaaaz39<br />undaaaz4a<br />undaaaz4b<br />undaaaz4c<br />undaaaz4d<br />undaaaz4e<br />undaaaz4f<br />undaaaz4g<br />undaaaz4h<br />undaaaz4i<br />undaaaz4j<br />undaaaz4k<br />undaaaz4l<br />undaaaz4m<br />undaaaz4n<br />undaaaz4o<br />undaaaz4p<br />undaaaz4q<br />undaaaz4r<br />undaaaz4s<br />undaaaz4t<br />undaaaz4u<br />undaaaz4v<br />undaaaz4w<br />undaaaz4x<br />undaaaz4y<br />undaaaz4z<br />undaaaz40<br />undaaaz41<br />undaaaz42<br />undaaaz43<br />undaaaz44<br />undaaaz45<br />undaaaz46<br />undaaaz47<br />undaaaz48<br />undaaaz49<br />undaaaz5a<br />undaaaz5b<br />undaaaz5c<br />undaaaz5d<br />undaaaz5e<br />undaaaz5f<br />undaaaz5g<br />undaaaz5h<br />undaaaz5i<br />undaaaz5j<br />undaaaz5k<br />undaaaz5l<br />undaaaz5m<br />undaaaz5n<br />undaaaz5o<br />undaaaz5p<br />undaaaz5q<br />undaaaz5r<br />undaaaz5s<br />undaaaz5t<br />undaaaz5u<br />undaaaz5v<br />undaaaz5w<br />undaaaz5x<br />undaaaz5y<br />undaaaz5z<br />undaaaz50<br />undaaaz51<br />undaaaz52<br />undaaaz53<br />undaaaz54<br />undaaaz55<br />undaaaz56<br />undaaaz57<br />undaaaz58<br />undaaaz59<br />undaaaz6a<br />undaaaz6b<br />undaaaz6c<br />undaaaz6d<br />undaaaz6e<br />undaaaz6f<br />undaaaz6g<br />undaaaz6h<br />undaaaz6i<br />undaaaz6j<br />undaaaz6k<br />undaaaz6l

<br /><br />Now comes the simple way which is simply changing the symbol "@" for the type of character we want to insert in the generation of the dictionary, remember that with the -t option, we can specify a pattern of characters that will be the only ones to change when generating the dictionary, so the characters we can specify for the pattern are:<br /><br />              @  will insert lowercase<br />              ,    will insert uppercase<br />              %  will insert numbers<br />              ^   will insert symbols<br /><br />Knowing this let's suppose we want to generate a dictionary where the first letter is uppercase, but that throughout it, both the 2nd and the 3rd character stay fixed, well to do it we add a "," that as I explained previously will insert uppercase, but let's remember that there was a number in the password, so we also need to insert 1 single number in the 7th character of our word, well we only count up to position number 7 and insert a "%" that as I also explained previously only inserts numbers, the final command would be like this: <br /><br />

crunch 9 9 -t ,nd@@@%@@<br />

<br /><br /><br /><br />All this flexibility we have achieved with the -t option, I hope you understood it and that it is very practical for you in the future. But don't think we have finished, Ohh no my friends!!! This continues and gets better!!!<br /><br />Let's see, we are going to generate a dictionary concatenating words, imagine why some people use as password a series of joined words, for example someone who likes harry potter could use the names of Harry, Hermione and Ron as password and in that case generating simply by characters would be almost impossible given the final length "harryhermioneron" so in crunch there is an option that allows us to concatenate words, let's see how:<br /><br />

crunch 1 1 -p Harry Hermione Ron<br />

<br /><br />We would get something like this:<br /><br /><br /><br />As you will have noticed with the -p option it is possible to concatenate words, but there is a particularity and it is that notice that in the part where the shorter and longer length are specified I have placed "1 1" and well the truth is that when the -p option is used the numbers are not processed, but they are necessary for the argument, meaning we can place anything and it will be irrelevant for the output.<br /><br />[/u][/b]<br /><br />Well having reached this point we already know how to generate dictionaries with different charsets, we know how to apply patterns in the generation, concatenate words, as well as specify with which characters we want to generate, so I consider that we are advancing in the task of undressing crunch.<br /><br />At the beginning of the workshop I said that crunch can send the results to the screen, can create a file or pass the output to another program (generally a cracker like aircrack) but up to now we have only output the results on screen, meaning no file or anything similar has been created, so let's get to it.<br /><br />   <br /><br />Well the basic idea of creating a dictionary is to be able to use it later to hit the valid hash in a brute force test, so somehow we must be able to generate a file from the output, this is possible using the -o (output) option followed by the file name, let's take as an example the exercise of Harry Hermione and Ron and create a file, the command would be:<br /><br />

crunch 1 1 -o NombresPotter.txt -p Harry Hermione Ron 

<br /><br /><br /><br />Optionally we could also specify the path where we want to dump the dictionary, for example:<br /><br />

crunch 1 1 -o /home/cl0udswx/Documentos/NombresPotter.txt -p Harry Hermione Ron

<br /><br /><br /><br />Let's go a bit deeper and make crunch generate 1 file every 5000 lines, well for what, depending on the environment in which the audit is going to be done we need to section the attack, that is divide the dictionary in a specific quantity, to achieve better coupling with the timers of the crackers, to achieve that division of a dictionary into several files of smaller size we use the -c option (this option only works if -o START is present on the line) for example:<br /><br />

crunch 1 1 -o /home/cl0udswx/Documentos/START -c 5000

<br /><br />This starts the process of creating multiple files with 5000 lines each, just as we can see in the image:<br /><br /><br /><br />And if I went to the documents folder I would find this:<br /><br /><br /><br />See how simple?<br /><br />Clarifications:<br /><br />[].- The START works as a file name for the first file to create, from there the files will take the name of the last line of the previous file + the first line of the following file<br /><br />[].- Although I must clarify that in some cases it is possible to fill the hard drive when generating a dictionary, it all depends on what we tell crunch, for example if I said:<br /><br />crunch 15 25 -o demasiado.txt<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Notice the size of the file?<br /><br />2744 PB !!!      :o<br /><br />That would be too much (demasiado.txt) for any hard drive.<br /><br />But among so much generation what if we create a file and compress it to bzip, in one single stroke, it sounds complicated but it would be simply adding the -z option followed by the desired compression type, for example:<br /><br />

crunch 4 5 -o /home/cl0udswx/Documentos/START -c 5000 -z gzip

<br /><br />This way the same previous process would start only in gzip compressed files or in any other format supported by crunch (gzip, bzip2, lzma, and 7z )<br /><br /><br /><br />Well as you can see it is not so complicated to send the output to a txt, gzip, bzip2, lzma or 7z file.<br /><br />

---

<br /><br /><br /><br />Well at the beginning of the post my idea was to explain all the functions of crunch, but it occurred to me that it would be interesting to let you contribute your bit to the post, so I wanted to leave you 2 exercises to do and send them to me by PM and then I'll update the post with the name and the solution.<br /><br />1.- How to generate a dictionary that passes the output to aircrack-ng using a pipe.<br /><br />2.- How to generate a dictionary that does not repeat characters per line and save it in a compressed file (the format doesn't matter)<br /><br />Greetings and until next time.