Original subtitles

‫From the previous lectures,

‫we learned that when it comes to WPA and WPA2,

‫the only packets that contain some information

‫that can help us with cracking the key,

‫are the handshake packets.

‫And in the last lecture, we learned how

‫to capture the handshake and store it in a file.

‫Now the handshake does not contain any information

‫that can help us to recover or recalculate the WPA key.

‫The information in it can only be used

‫to check whether a password is valid or not.

‫Therefore, what we're going to do is to create a wordlist,

‫which is basically a big text file

‫that contains a large number of passwords.

‫Then go through this file,

‫go through the passwords one by one,

‫and use them with the handshake

‫in order to check whether this password is valid or not.

‫You can actually download ready wordlists from the internet,

‫but in this lecture, I wanna teach you

‫how to create your own wordlist,

‫and in the next lecture I'm going to explain to you

‫how the wordlist and the handshake are used

‫in order to recover the password,

‫and we'll see how to do that in practice.

‫So, in this lecture we're gonna learn

‫how you create your own wordlist using a tool called Crunch.

‫This is a really handy skill to have under your belt

‫if you want to be a penetration tester,

‫because you're gonna face a lot of scenarios

‫where a wordlist attack can become very handy.

‫So, using the tool is very simple.

‫All you have to do is just put the name of the tool,

‫and then you specify the minimum number of characters

‫for the passwords to be generated.

‫Then we're gonna specify the maximum number of characters

‫for the password.

‫Then you specify the characters

‫that you want to generate passwords from.

‫For example, you can put all lowercase characters,

‫all uppercase, you can put numbers, digits,

‫or you can just specify a smaller number

‫to make the wordlist smaller.

‫You can also use the option T, which is an optional,

‫to give a pattern.

‫So for example, let's say that you are looking at the person

‫while they were typing their password,

‫and you seen that the password would start with an A.

‫So you can tell Crunch that the password

‫will start with an A,

‫and then give me all possible combination of passwords

‫that start with an A.

‫And after that, we use the -o option

‫to specify the file name where the passwords

‫are gonna be stored.

‫So we have a small, little example here

‫that'll generate a list of passwords

‫that start from six characters to eight characters,

‫and contain these characters right here.

‫So it's gonna create combinations of 123abc,

‫and a dollar sign.

‫And it's gonna store it in a file called wordlist.

‫And these passwords are gonna start with an A,

‫and end with a B.

‫And it will generate passwords based

‫on all possible combinations between the A and the B,

‫so all of the generated passwords will always start with A,

‫and end with B.

‫So let's have an example of the tool.

‫Now the tool actually have a lot of options,

‫other than what we've seen so far.

‫So if you just type in man, crunch,

‫you'll see all the options that you can set,

‫and you'll see detailed description

‫about all of these options.

‫So it's actually really, really good.

‫You can go ahead and spend some time

‫to get familiar with the tool.

‫Now I'm gonna show you the example,

‫and based on the example, you'll be able to run

‫all of these commands.

‫But, if you want to run or create some advanced wordlists,

‫then I highly recommend that you go over this.

‫One of the really cool options that I wanna highlight

‫is the -p option.

‫The -p option tells Crunch to generate passwords

‫that don't have repeating characters.

‫For example, when you specify all lowercase characters,

‫you specify abcd, it'll start by generating passwords made

‫of aaaaaaa, and then abbbbb, and all of that.

‫So, when you do this, Crunch will actually ignore these type

‫of passwords, and it'll only create passwords

‫that don't have any repeating characters.

‫And that'll reduce the size of the wordlist

‫from the number of characters to the power of the length,

‫to the number of characters factorial.

‫If you scroll down you'll actually see more examples

‫of commands and the type of wordlists

‫that will be created.

‫So, again, you can have a look on these,

‫and get yourself familiar with.

‫Once you're done looking at the man,

‫you can just press Q, and you'll be out of it.

‫And we're gonna run our command here,

‫so we're gonna use Crunch.

‫And I want to generate passwords

‫of minimum of six characters,

‫and maximum of eight characters.

‫And I want them to contain combinations of abc.

‫And let's say the digits 1-2.

‫Now in here you can actually keep listing things.

‫You can list characters, you can list uppercase characters,

‫or even symbols if you wanted to.

‫Once you're done with listing the characters,

‫we're gonna specify the file to save it to.

‫And we're gonna save it in a file called test.txt.

‫So the command is very simple.

‫It's crunch, minimum length of the password,

‫the maximum length of the password,

‫followed by the characters that we want to use

‫to generate passwords from, and then O

‫to the file that the passwords are gonna be stored in.

‫I'm gonna hit Enter.

‫And as you can see, now it's telling us

‫that it generated 448,000 passwords, approximately.

‫And they're all stored in a file called test.txt.

‫Now, the size of the file is four megabytes.

‫And now I can open this file by doing cat, test.txt.

‫And as you can see, now we can see all the passwords

‫that have been generated.

‫I'm gonna Ctrl+C out of it, 'cause it's a huge file.

‫And as you can see, it actually contains

‫all possible combinations of abc12.

‫I also want to show you an example of using the -t option.

‫So, I'm gonna set this to only six to six,

‫so it's only six characters.

‫And we're gonna use the -t option,

‫which is the pattern option.

‫And I'm gonna tell it that I want the password

‫to always start with an A.

‫And then I want you to fill all possible combinations

‫of characters between the A, and the B.

‫So I want passwords that start with an A,

‫and end with a B.

‫And in the middle, at the at sign,

‫you can fill all possible combinations of abc12.

‫Gonna hit Enter.

‫As you can see now, the number of passwords is much less,

‫it's only 625 passwords, because I've narrowed down

‫the possibilities of passwords.

‫Again, if I do cat, test.txt,

‫you'll see that I have all the passwords right here.

‫So this is it, tool is really useful.

‫Can be used in many scenarios.

‫I highly recommend that you spend some time with it,

‫and also have a look on some

‫of the existing wordlists out there on the internet.