Welcome to part three of this module in the prior module.
We went over the word list creation utility.
Cool.
Now it's time to take a look at its cousin crunch.
I have to state up front that crunch is a little weird in terms of its application and its usefulness
may be highly situational.
Crunch is another word list creation tool that comes prepackaged with Kelly Linux 2.0.
Since the process of creation is rather slow we'll jump right into it.
Crunch can be loaded by going to applications.
Password attacks and selecting crunch
but since this is really a terminal only application we're gonna go ahead and load load it from the
terminal
we'll type crunch Tack Tack each for help right away we can see that this program is basically a one
trick pony.
It doesn't come with a wide range of options but what options are available can be viewed by looking
at the man page for crunch.
I'm not really going to go through all of these.
You can read through them at your leisure and then is bait.
Basically because despite having several switches this program really only does just one thing.
So to start out we're going to make a directory called Crunch
output and we'll see you right into its.
There we go.
And we'll get this started.
I wanted to get this running before I start talking about it because it's going to be a rather slow
process to finish crunch generates word lists based on whatever criteria you set for it.
It is excellent for generating character string combinations.
However calling it a word list generator might be slightly misleading and when this process finishes
you'll see what I mean when we initiated crunch we specified a minimum number of characters and a maximum
number of characters.
We also used the tack o option to specify an output file which is always placed into whatever directory
you happen to be in when you launch.
Crunch if we did not use the TAC o option to specify a file name crunch would display its word list
combinations in the terminal window and this would probably be a very little used to us.
So in case this isn't clear what I mean is that the first number we specified was three.
This means that crunch will only create words or more accurately character strings that are a minimum
of three characters long.
The second number which in this case was 6 is the maximum length for those strings.
In other words crunch will only create strings between three to six characters long.
This is handy for situations where you know certain things about your target.
For example if you know that the service your attacking has a password policy that calls for a minimum
number of characters to be accepted you wouldn't necessarily want anything below that minimum.
By the same token if you know that the target has a maximum character limit to the passwords that it
will accept you obviously wouldn't want anything above that maximum.
That being said I didn't mention in the cool tutorial that this does not cover situations where a user
uses a particularly short word and then adds numbers or characters to that string in the hopes of making
it more secure.
Then again if you know the exact length of the specific user's password for instance you've seen the
password typed and you counted the number of asterisks.
Crunch can really come into its own.
So while this is running I wish to call your attention to the powerful word lists that do in fact come
prepackaged with Cali Linux to find them.
Just go in to your computer look at other locations.
User share and then we'll use the search feature to look for word lists
once you get that open.
You can see all of the word lists that come pre installed with Cali Linux.
I mentioned in another module that the word lists included in the Metis Floyd folder are quite nice
and the great thing about these is that they are not only very powerful but they are based on different
kinds of attacks.
For instance we have our rescue element text file.
We have an end map word list and we even have what some consider to be the most popular word list in
the world.
The rock you word list rock u contains several leaked or stolen credentials which are actually passwords
from Web sites that were distributed after famous hacks such as for example the Ashley Madison hack
that I believe I mentioned in the last video.
Since these are actual password combinations that real human beings tend to use these word lists are
considered more powerful than anything that is randomly computer generated you're more likely to get
a positive result quicker if you make use of them by default using something like crunch is a bit like
taking a shot in the dark.
That's because you might be able to crack a log in but you're just as likely to devote tremendous amounts
of time and then end up with a failed exploit or an unsuccessful brute force attack.
I'm not saying this to bash crunch it's just important to keep in mind that a program like this is very
much a roll of the dice in terms of its effectiveness.
In any case these will all come in very handy whenever you do not wish to generate your own list and
you can always combined an existing list with one that you create for extra coverage.
The inclusion of these lists is one of the big steps forward in terms of Carly's development and ease
of use because in the old days of backtrack you were pretty much stuck either creating your own lists
with the limited applications that were available or downloading them off the Internet from shady Web
sites and hoping for the best.
Now with so many Reddit readily available lists users have a great starting point to just jump into
any application that requires them so foot flipping back to crunch here may be done.
So again make sure that you are working in whatever directory you wish to store your word list when
you run crunch.
This is very important because unlike cool there really isn't any other way to specify where you want
the file to be saved and the file created by crunch tends to be very large.
In this case I created a folder specifically for this purpose.
You might just prefer to save yours on the desktop.
It is also possible to specify a character set when running crunch.
This would limit crunch to only using certain characters when it generates the list.
Of course this is getting into highly situational territory as I said you could after giving it the
minimum and maximum character length type out a string of characters such as the alphabet in lower case
than in uppercase and then a sequence of numbers.
Or you could type out the alphabet from Ada G.
Doing this would cause crunch to only use the characters that you specifically input so that would look
like this crunch minimum length 3 maximum length 6 ATC D E F G one two three four five and then crunch
output text and this is what it might look like.
This would be a very specialized situation of course and not something you'd ever do just by default.
Were right to hit enter and I'm not going to because it would take more time crunch would create a word
list that would only contain various combinations of the characters that we entered.
So in this case A to G and 1 2 5 is this route.
Is this feature really useful.
I'll let you be the judge
so scrolling up for a minute here do notice that the amount of data crunch generates is relative to
the character sets that you provide.
In this case by default it only went up to 2 gigabytes but it's possible to create word lists in the
terabyte or even petabytes range and just in case you are new to brute forcing it's worth pointing out
that trying to use a word list in the petabytes range to brute force a password particularly on any
kind of normal personal computer made in the last decade is likely going to take you several million
years.
Bigger is not always better.
Programs like cool and crunch both allow you to tailor your word lists for your target.
Cool is more about creating lists using things like social media profiles and the like to tailor your
word list for your target.
Crunch is about tailoring the length of the random character strings and using specific character sets
when you know only the limitations of a log in or simply the password lengths involved.
So now let's open up and take a look at the file that crunch created by the way.
I strongly recommend that you not attempt to cap this file for reasons that will be obvious in a moment.
This is going to take a moment to load and by a moment I mean for more than a moment because as you
can see this is a very very long file and I'm not going to let it load all the way because these are
just strings of letter and number combinations starting in sequences of 3 and going all the way up to
6
every possible character combination for character set used is printed here and the odds of one of them
being a valid password probably pretty low.
Knowing when to use a tool like cool or crunch is really the trick.
And it's a question that only you can answer.
It's worth keeping in mind how they go about creating word lists and what their strengths and weaknesses
are.
Remember that brute forcing a target is almost always a last resort when better more subtle methods
have already failed.
At least that is how I personally look at it.
If you've been following along with these modules in order you've already seen some examples of how
brute forcing can indeed yield some good results.
I would never suggest that this method is not effective.
However what you really need to keep in mind is the amount of time that this sort of approach takes
against real targets out in the wild.
It really is like shooting in the dark and unless you take steps to narrow the scope of your attack
with cool and crunch and other such utilities or unless you use a word list like rock you with real
world examples rather than endless combinations of nonsense characters you probably aren't going to
get very far or very fast.
Full disclosure while I've personally enjoyed a considerable amount of success with cool I can't think
of a single instance where crunch ever gave me a successful result.
Then again a good example of using it might be for something like an encrypted file that you wish to
crack where you know due to weak precautions the exact number of characters that were used in the password
and you know that the person using the encryption was smart enough to use characters and numbers that
don't equate to real words certain techniques involving collision can reveal this information on older
forms of encryption such such as SHA 1.
Essentially in this case you would try every letter in no sequence that is what say maybe seven characters
long.
If that were the known length the password and sooner or later you'd probably hit the right combination.
So to conclude crunch is a useful and powerful tool but only in the right situation and it really is
on you to find the right moment to use this particular tool.
And as always.
Never use any word list to brute force a target that you do not personally own or have written permission
from the owner to penetration test.
Or you could be breaking the law.
Thank you.