Instructor: From the previous lectures,
we learned that when it comes to WPA and WPA2,
the only packets that contain some information
that can help us with cracking the key,
are the handshake packets.
And in the last lecture, we learned how
to capture the handshake and store it in a file.
Now the handshake does not contain any information
that can help us to recover or recalculate the WPA key.
The information in it can only be used
to check whether a password is valid or not.
Therefore, what we're going to do is to create a wordlist,
which is basically a big text file
that contains a large number of passwords.
Then go through this file,
go through the passwords one by one,
and use them with the handshake
in order to check whether this password is valid or not.
You can actually download ready wordlists from the internet,
but in this lecture, I wanna teach you
how to create your own wordlist,
and in the next lecture I'm going to explain to you
how the wordlist and the handshake are used
in order to recover the password,
and we'll see how to do that in practice.
So, in this lecture we're gonna learn
how you create your own wordlist using a tool called Crunch.
This is a really handy skill to have under your belt
if you want to be a penetration tester,
because you're gonna face a lot of scenarios
where a wordlist attack can become very handy.
So, using the tool is very simple.
All you have to do is just put the name of the tool,
and then you specify the minimum number of characters
for the passwords to be generated.
Then we're gonna specify the maximum number of characters
for the password.
Then you specify the characters
that you want to generate passwords from.
For example, you can put all lowercase characters,
all uppercase, you can put numbers, digits,
or you can just specify a smaller number
to make the wordlist smaller.
You can also use the option T, which is an optional,
to give a pattern.
So for example, let's say that you are looking at the person
while they were typing their password,
and you seen that the password would start with an A.
So you can tell Crunch that the password
will start with an A,
and then give me all possible combination of passwords
that start with an A.
And after that, we use the -o option
to specify the file name where the passwords
are gonna be stored.
So we have a small, little example here
that'll generate a list of passwords
that start from six characters to eight characters,
and contain these characters right here.
So it's gonna create combinations of 123abc,
and a dollar sign.
And it's gonna store it in a file called wordlist.
And these passwords are gonna start with an A,
and end with a B.
And it will generate passwords based
on all possible combinations between the A and the B,
so all of the generated passwords will always start with A,
and end with B.
So let's have an example of the tool.
Now the tool actually have a lot of options,
other than what we've seen so far.
So if you just type in man, crunch,
you'll see all the options that you can set,
and you'll see detailed description
about all of these options.
So it's actually really, really good.
You can go ahead and spend some time
to get familiar with the tool.
Now I'm gonna show you the example,
and based on the example, you'll be able to run
all of these commands.
But, if you want to run or create some advanced wordlists,
then I highly recommend that you go over this.
One of the really cool options that I wanna highlight
is the -p option.
The -p option tells Crunch to generate passwords
that don't have repeating characters.
For example, when you specify all lowercase characters,
you specify abcd, it'll start by generating passwords made
of aaaaaaa, and then abbbbb, and all of that.
So, when you do this, Crunch will actually ignore these type
of passwords, and it'll only create passwords
that don't have any repeating characters.
And that'll reduce the size of the wordlist
from the number of characters to the power of the length,
to the number of characters factorial.
If you scroll down you'll actually see more examples
of commands and the type of wordlists
that will be created.
So, again, you can have a look on these,
and get yourself familiar with.
Once you're done looking at the man,
you can just press Q, and you'll be out of it.
And we're gonna run our command here,
so we're gonna use Crunch.
And I want to generate passwords
of minimum of six characters,
and maximum of eight characters.
And I want them to contain combinations of abc.
And let's say the digits 1-2.
Now in here you can actually keep listing things.
You can list characters, you can list uppercase characters,
or even symbols if you wanted to.
Once you're done with listing the characters,
we're gonna specify the file to save it to.
And we're gonna save it in a file called test.txt.
So the command is very simple.
It's crunch, minimum length of the password,
the maximum length of the password,
followed by the characters that we want to use
to generate passwords from, and then O
to the file that the passwords are gonna be stored in.
I'm gonna hit Enter.
And as you can see, now it's telling us
that it generated 448,000 passwords, approximately.
And they're all stored in a file called test.txt.
Now, the size of the file is four megabytes.
And now I can open this file by doing cat, test.txt.
And as you can see, now we can see all the passwords
that have been generated.
I'm gonna Ctrl+C out of it, 'cause it's a huge file.
And as you can see, it actually contains
all possible combinations of abc12.
I also want to show you an example of using the -t option.
So, I'm gonna set this to only six to six,
so it's only six characters.
And we're gonna use the -t option,
which is the pattern option.
And I'm gonna tell it that I want the password
to always start with an A.
And then I want you to fill all possible combinations
of characters between the A, and the B.
So I want passwords that start with an A,
and end with a B.
And in the middle, at the at sign,
you can fill all possible combinations of abc12.
Gonna hit Enter.
As you can see now, the number of passwords is much less,
it's only 625 passwords, because I've narrowed down
the possibilities of passwords.
Again, if I do cat, test.txt,
you'll see that I have all the passwords right here.
So this is it, tool is really useful.
Can be used in many scenarios.
I highly recommend that you spend some time with it,
and also have a look on some
of the existing wordlists out there on the internet.