WEBVTT

00:00:01.040 --> 00:00:03.170
[Autogenerated] it's time for the first demo.

00:00:03.740 --> 00:00:05.750
Let's continue our hash cut,

00:00:05.760 --> 00:00:10.900
password cracking journey and let me show you how you can launch a dictionary.

00:00:10.900 --> 00:00:12.470
Attack within mask.

00:00:14.740 --> 00:00:16.360
In the previous demos,

00:00:16.370 --> 00:00:22.070
I launched a classical dictionary attack and a dictionary attack with a rule,

00:00:22.640 --> 00:00:27.560
and as a result of these two attacks, I cracked seven passwords.

00:00:28.440 --> 00:00:32.460
Now let me launch a dictionary attack with a mask,

00:00:32.940 --> 00:00:35.460
also known as a hybrid attack.

00:00:35.840 --> 00:00:40.970
And let me show you how you can crack even more passwords with this attack.

00:00:41.940 --> 00:00:42.620
First,

00:00:42.820 --> 00:00:47.730
I will briefly explain to you what a mask is and how it

00:00:47.730 --> 00:00:50.150
can be used in password cracking.

00:00:51.240 --> 00:00:56.410
Let's assume that we have a password dictionary and secure

00:00:56.410 --> 00:01:00.370
password is one of the passwords in this dictionary.

00:01:01.140 --> 00:01:07.620
It turns out that people often upend digits at the very end off their passwords.

00:01:07.630 --> 00:01:12.850
And then the password is, for example, secure password.

00:01:12.860 --> 00:01:21.670
1234 The idea behind a dictionary attack with a mask is to combine the

00:01:21.670 --> 00:01:25.850
passwords from a dictionary together with a mask.

00:01:26.240 --> 00:01:27.080
For example,

00:01:27.080 --> 00:01:31.010
four digits appended at the very end off every

00:01:31.010 --> 00:01:33.650
password from the password dictionary,

00:01:34.240 --> 00:01:40.360
and that's the reason why this attack is also known as a hybrid attack.

00:01:41.440 --> 00:01:48.010
And if our mask is composed off four digits appended at the very end

00:01:48.020 --> 00:01:51.370
off every password from the password dictionary,

00:01:51.740 --> 00:01:57.330
then for the password secure password hash cut will

00:01:57.330 --> 00:02:00.070
check all password combinations.

00:02:00.740 --> 00:02:06.120
Secure password 0000 Secure password.

00:02:06.200 --> 00:02:09.960
0001 Secure password.

00:02:10.020 --> 00:02:16.270
0002 and the last combination will be secure.

00:02:16.270 --> 00:02:17.010
Password.

00:02:17.020 --> 00:02:26.360
9999 Okay, Now you understand how a dictionary attack with a mask works.

00:02:26.370 --> 00:02:31.460
So let me show you how you can launch this attack Using Hash Cat.

00:02:32.740 --> 00:02:37.570
Here is the hash cut command that I used in the previous demo.

00:02:38.040 --> 00:02:43.780
What I want to do in this demo is append a mask at the very

00:02:43.780 --> 00:02:46.760
end off every password from my password,

00:02:46.760 --> 00:02:47.760
the dictionary.

00:02:48.110 --> 00:02:51.060
That's why I have to use the attack mode.

00:02:51.440 --> 00:02:56.750
Dash a six instead off dash a zero.

00:02:57.540 --> 00:02:58.530
What's more,

00:02:59.140 --> 00:03:02.800
I will delete the rule that I used in the previous

00:03:02.800 --> 00:03:10.560
demo and after dictionary dot txt, which is my password dictionary.

00:03:10.940 --> 00:03:15.850
I will specify the mask question Mark de question,

00:03:15.850 --> 00:03:18.910
Mark de question, Mark de question.

00:03:18.910 --> 00:03:25.220
Mark D, The character D SSHD stands for a digit and this way,

00:03:25.230 --> 00:03:30.860
Hash cat will take every single password from the password dictionary.

00:03:31.440 --> 00:03:35.370
It will upend a four digit number at the very end.

00:03:36.140 --> 00:03:41.950
And it will go through all four digit combinations off this number for

00:03:41.960 --> 00:03:45.350
every single password from the password dictionary.

00:03:46.840 --> 00:03:51.370
Okay, Now it's time to launch a dictionary attack with a mask.

00:03:52.240 --> 00:03:54.370
But before I launched this attack,

00:03:54.740 --> 00:03:59.340
I want to remind you that a classical dictionary attack and a

00:03:59.340 --> 00:04:03.460
dictionary attack with a rule presented in the two previous

00:04:03.460 --> 00:04:07.250
demos cracked seven out of 10 passwords.

00:04:07.940 --> 00:04:09.220
Now I will hit.

00:04:09.220 --> 00:04:09.770
Enter.

00:04:10.140 --> 00:04:13.190
I will launch a dictionary attack with a mask,

00:04:13.200 --> 00:04:18.750
and I will check if this attack results in cracking even more passwords.

00:04:19.839 --> 00:04:25.360
As you can see, hash cut cracked nine out off 10 passwords.

00:04:26.240 --> 00:04:28.070
And in the previous demo,

00:04:28.080 --> 00:04:32.160
you learned that hash got remembers the state off password

00:04:32.160 --> 00:04:36.260
cracking from the very beginning till this moment.

00:04:37.240 --> 00:04:44.440
So if I cracked seven passwords in the previous two demos using a classical

00:04:44.440 --> 00:04:48.210
dictionary attack and a dictionary attack with a rule.

00:04:48.220 --> 00:04:51.110
And now, in the first demo,

00:04:51.120 --> 00:04:57.060
I see nine cracked passwords after launching a dictionary attack with a mask.

00:04:57.440 --> 00:05:01.500
Then it means that the dictionary attack with a mask.

00:05:01.550 --> 00:05:04.460
Cracked additionally to passwords.

00:05:04.840 --> 00:05:07.270
And you can see these passwords here.

00:05:08.140 --> 00:05:16.910
Mark 1975 and New York 1234 So, as you can see,

00:05:16.980 --> 00:05:21.290
a dictionary attack with a mask also known as a

00:05:21.290 --> 00:05:24.390
hybrid attack is really powerful.

00:05:24.590 --> 00:05:27.560
It can help you crack even more passwords.

00:05:28.140 --> 00:05:29.270
And in this demo,

00:05:29.270 --> 00:05:34.560
you learned how you can launch this attack in practice using hash cat.