Tutorial: Create Wordlists with Crunch « Null Byte :: WonderHowTo

Greetings all. Before I get into the tutorial, I would like to mention that I am fairly new to Null Byte (been lurking for some time though), and what really appeals to me about this place is its tight, family-like community where everyone is always willing to help each other and the constant search for knowledge that inhabits this subdomain is a driving motivator for me to join in. I'm glad I arrived at the right time. Anyway,wipes tears(not really)...This is a tutorial for newbies and anyone who hasn't yet used Crunch before. Crunch is a utility that is used to create wordlists using letters, numbers, and symbols for every possible combination or according to specific rules. I will be covering this command-line tool in great depth, dissecting each option and demonstrating its purpose. So to start off, in this demonstration I will not assume that you have a particular OS, other than to mention that I will only be covering those based on UNIX.To begin with,download Crunchand navigate to the downloaded tgz file in Terminal. Then unzip the tgz file and install crunch.> cd /path/to/folder/containing/crunch-3.6.tgz> tar -xf crunch-3.6.tgz> cd crunch-3.6 && make && make installSo now you can call thecrunchcommand from anywhere in the Terminal app. Great, so now that it's out of the way, let's get straight into the usage. The syntax for Crunch is:> crunch min max charset optionsTheminandmaxare the minimum and maximum lengths (respectively) for your desired wordlist. By defaultcharsetis not required, but you can use it to limit the characters of your wordlist to the ones you specify. If you choose to usecharsetthen you must maintain the correct order, which is lowUP123@%# (lowercase letters, then uppercase letters, then numbers and finally symbols). You can skip any of them, but the order must always remain the same. Example:> crunch 2 6 qrs347The command above will produce a wordlist for every possible combination of the characters qrs347 from 2 to 6 characters in length.Now let's look at the options.-b : the maximum size of the wordlist (requires -o START)-c : numbers of lines to write to the wordlist (requires -o START)-d : limit the number of duplicate characters-e : stop generating words at a certain string-f : specify a list of character sets from the charset.lst file-i : invert the order of characters in the wordlist-l : allows the literal interpretation of @,%^ when using -t-o : the output wordlist file-p : print permutations without repeating characters (cannot be used with -s)-q : Like the -p option except it reads the strings from a specified file-r : resume a previous session (cannot be used with -s)-s : specify a particular string to begin the wordlist with-t : set a specific pattern of @,%^-z : compress the output wordlist file, accompanied by -oReference:@ represents lowercase letters, represents uppercase letters% represents numbers^ represents special charactersExamples:1) > crunch 5 5 abcde14 -t @@@14 -d 2@ -o syskey.txt -zA zipped syskey.txt wordlist starting with "aab14" and ending in "eed14" will be produced from the above. The reason why the start is not "aaa14" is because -d 2@ allows for only 2 duplicate lowercase letters. Adding -i would invert the results, and adding -e dde14 would stop after the line "dde14" (or "41edd" in the case of an inverted output) is produced.2) > crunch 5 5 bcopuw2468 -s cow28 -c 33 -b 20mb -o STARTThe above will result in a 20mb text file and containing combinations for bcopuw2468 starting with "cow28" and ending on the 33rd line of the theoretical outcome.3) > crunch 2 4 -p kite sky car -o owl.txtIn this example the words 'kite' 'sky' and 'car' will be printed in all orders possible (wholly, not by letter) and outputted into output owl.txt without taking into account the min and max numbers. None of the words will be repeated. If only one word is included, it will will be used as a character set. You could use -q instead of -p to extract words from a specific file.4) > crunch 6 6 -t @^42%3 -l a^aaaa -o art.txtIn this case Crunch will will treat the ^ symbol as itself, rather than a representative of a special character. The sequence will commence with "a^4213" and end in "z^4293" and the output art.txt will be produced.5) > crunch 4 6 -f /path/to/charset.lst -o words.txtAssume the situation where you enter the above command and then decide to pause the process midway. When you come back later, you may restore the session by adding -r option to the syntax, while keeping the rest exactly the same.If you still feel the need to mud your feet by reading paragraphs of illustrations and explanations for eons, you may type...> man crunch...to view the Crunch manual, but there's no need since we've just examined it from head to toe.Now that we have it all covered, you have access to limitless ways in which you could use Crunch during a penetration test. One could obviously point out that it acts great as a password generator, so in turn being useful for password cracking using let's say Hydra or John. I will divulge all of the uses of wordlists in a future tutorial, and other utilities that you could use to perfect the relevance of the contents of said wordlists, thereby enabling a more thorough approach to password cracking or other similar scenarios.Before concluding this how-to, I would like to mention that I will be prolonging this series to cover many different tools used in the sphere of hacking, and possibly a future series relating to privacy and how it can be achieved in an effective way. Please feel free to add suggestions to anything. I'm more than happy to receive feedback.That's it for today, I hope you all learned the ins and outs of the tool Crunch, and expect many similar tutorials in the coming days/weeks.TRTWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:How to Crack Passwords, Part 4 (Creating a Custom Wordlist with Crunch)Hack Like a Pro:How to Crack Passwords, Part 5 (Creating a Custom Wordlist with CeWL)How To:Brute-Force Email Using a Simple Bash Script (Ft. THC Hydra)How To:Use Wordlister to Create Custom Password Combinations for CrackingHow To:Automate Brute-Force Attacks for Nmap ScansHack Like a Pro:How to Crack Online Web Form Passwords with THC-Hydra & Burp SuiteHow To:Brute-Force WPA/WPA2 via GPUHack Like a Pro:How to Hack Web Apps, Part 7 (Finding Hidden Objects with DIRB)How To:Scan Websites for Interesting Directories & Files with GobusterHow To:Crack MD5 Hashes with All of Kali Linux's Default WordlistsHack Like a Pro:Abusing DNS for ReconnaissanceHack Like a Pro:How to Crack Passwords, Part 3 (Using Hashcat)How To:Do a bodybuilding crunch exercise for 6-pack absTutorial:Password Profiling with CUPPHow To:Draw Captain CrunchHow To:Do vertical leg crunchesHow To:Make Wordlist with Cupp