4 ms·

4,733,979 out of the 14,344,391 passwords (33%) in the rockyou.txt dictionary file used for cracking in this guide are too short to be WPA2 passwords, which hav

by polpo 9y ago

4,733,979 out of the 14,344,391 passwords (33%) in the rockyou.txt dictionary file used for cracking in this guide are too short to be WPA2 passwords, which have a minimum length of 8 characters. Are aircrack and/or hashcat smart enough to not bother hashing those short passwords?

polpo 9y ago
(looks like the case for aircrack-ng, at least: https://github.com/aircrack-ng/aircrack-ng/blob/master/src/aircrack-ng.c#L4753 https://github.com/aircrack-ng/aircrack-ng/blob/master/src/a...)
domenukk 9y ago
5 million hashes only take a few seconds for wpa2 anyway... Less than two for this system: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...
- stusmall 9y ago
  They don't touch it in this tutorial but typically you don't check just whats in your dictionary. You also use a set of rules to manipulate your dictionary that massively increases the number of hashes to perform. Those 5 million entries quickly passes tens of billions hashes that need to be run. These initial entries might be too short like OP pointed out, but after the rules are applied it might generate many entries that will be long enough to spend time hashing. The keyspace for WPA is huge and the hash speed is still relatively slow, even with an extremely high end system like you linked to the quality of the initial dictionary is really important.
weinzierl 9y ago
hashcat is smart enough in a subtle way. It will not bother with candidates that are unsuitable for a certain hash type. It checks this after the rules have been applied. (stusmall's comment explains the influence of rules better than I could). Hashcat shows these candidates as "Rejected". The interesting part is that you can't configure the minimum or maximum length anymore[1], the restrictions are hard coded for every hash type. This is because for fast hashes the branch introduced by the check would be slower than just hashing away[2]. [1] It was possible with the old CPU-based hashcat (--pw-min and --pw-max) [2] https://hashcat.net/forum/thread-3444.html?highlight=branch https://hashcat.net/forum/thread-3444.html?highlight=branch

by polpo 9y ago

polpo 9y ago

(looks like the case for aircrack-ng, at least: https://github.com/aircrack-ng/aircrack-ng/blob/master/src/aircrack-ng.c#L4753 https://github.com/aircrack-ng/aircrack-ng/blob/master/src/a...)

domenukk 9y ago

5 million hashes only take a few seconds for wpa2 anyway... Less than two for this system: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...

stusmall 9y ago
They don't touch it in this tutorial but typically you don't check just whats in your dictionary. You also use a set of rules to manipulate your dictionary that massively increases the number of hashes to perform. Those 5 million entries quickly passes tens of billions hashes that need to be run. These initial entries might be too short like OP pointed out, but after the rules are applied it might generate many entries that will be long enough to spend time hashing. The keyspace for WPA is huge and the hash speed is still relatively slow, even with an extremely high end system like you linked to the quality of the initial dictionary is really important.

weinzierl 9y ago

hashcat is smart enough in a subtle way. It will not bother with candidates that are unsuitable for a certain hash type. It checks this after the rules have been applied. (stusmall's comment explains the influence of rules better than I could). Hashcat shows these candidates as "Rejected". The interesting part is that you can't configure the minimum or maximum length anymore[1], the restrictions are hard coded for every hash type. This is because for fast hashes the branch introduced by the check would be slower than just hashing away[2]. [1] It was possible with the old CPU-based hashcat (--pw-min and --pw-max) [2] https://hashcat.net/forum/thread-3444.html?highlight=branch https://hashcat.net/forum/thread-3444.html?highlight=branch