- In previous videos which I've linked below,
I showed you how to use pre-built wordlists
within Kali to crack WPA passwords.
In this video, I'm gonna show you how you can create
your own wordlists.
We're gonna use an application called crunch
which makes it very, very easy to create
various types of wordlists.
So if you wanna create your own wordlist
this is a very easy way to do it.
Okay so in Kali if I type wordlists,
I can see pre-built wordlists.
Various wordlists are found in usr/share/wordlists.
So as an example, the rockyou wordlist
is a very popular wordlist.
This wordlist contains millions of passwords.
Great wordlist to use if you wanna try and crack passwords.
These are stolen passwords
so these are actual passwords that people have used.
Millions of passwords in this wordlist.
Various other wordlists are available.
We've got an nmap wordlist, we've got metasploit,
fasttrack, various other wordlists,
but let's create our own wordlists.
So to do that, I'm gonna use the command crunch
and if you use -h, that'll give you help.
You can also use --help,
gives you similar kind of information.
So, once again crunch --help.
The command to use if fairly simple
it's crunch minimum password length,
maximum password length
and then we've got a whole bunch of options.
Okay so let's go to my home directory
and let's use the command crunch.
Minimum password length will be one,
maximum will be five,
I'm gonna output the data to mywordlist1.
Press Enter.
It will generate this amount of data,
70 meg in size, it's not a gig or a terabyte, or petabyte,
so many lines have been generated.
So I can use the command less mywordlist
to read that wordlist.
You can see password length is a
because we started with one
and then it goes to two characters.
If I continue down, this will then go to three characters
and then we'll continue until I get to four
and then five characters.
So it's created and I'll just go to the end of the file.
Notice it's created passwords from going through the top, a,
going to the end, five Zs, or five Z's if you prefer.
And that's once again, because we specified password length
of one to five.
I didn't specify the characters to use,
so it only used lowercase in this example.
So I'll clear the screen
and let's run crunch again.
In this example, I'll specify 8 to 8,
so minimum length is eight, maximum length is eight.
These are the characters to use and the password,
so digits zero, one, two, up to nine
and I'm gonna output this to wordlist2.
Because I previously typed this command,
I can press the right key in Kali
to autocomplete the command.
But once again, command is crunch,
minimum, maximum length, characters to use
and I'm gonna output the information to this file.
This will now contain 100 million lines.
It's 858 meg in size.
So as you can see, this is a much bigger file.
We can see that it's generated 78%
and now 100% of the output.
If I type less mywordlist2,
because that's the wordlist that I created,
you can see that it starts with eight zeros,
then seven zeros and a one,
seven zeros and a two
and just goes through all the options.
So paging down, you can see it then goes to 1000s
and this will just continue through all the variations,
so all the variations from eight zeros
and go right to the end, eight nines.
And if I go backwards, you can see all those combinations.
So clear the screen.
LS shows me that I've got my two wordlists
which I could use.
So once again, if I look at my first wordlist,
that's what it contains.
And then if I look at my second wordlist,
that's what it contains.
It's very simple to create wordlists using crunch.
Now, there are a lot of options with crunch.
You can use the command man crunch to see the documentation
or manual with regards to crunch.
So once again, command is crunch,
minimum length, maximum length, character string
and any options that you wanna use.
Minimum length is the minimum number of characters
in a password, maximum is maximum,
that's fairly simple,
then you can specify the character strings to use.
So let's do another example of that.
So as an example, crunch minimum character is one,
maximum character is five.
We've got lowercase, we've got uppercase
and then we've got digits
and I'm gonna output that to the file called mywordlist3.
In this example, it's gonna be 5313 meg,
that's the number of lines that it's gonna generate,
that's the number of bytes.
You can see it's 9% completed.
Now, in a separate video, which I've linked here and below,
I showed you how to use a GPU to do a brute-force attack
using hashcat against WPA passwords.
So you could pre-generate passwords using crunch,
or you could just go and use a brute-force attack
using a GPU.
I'll show you some additional brute-force attacks,
using a very powerful GPU in another computer
in a separate video,
but this shows you how easy it is
to create basic wordlists using crunch.
You can see at this point, it's at 69%.
In this example, I'm using Kali within a virtual machine
on my Mac, so I'm not getting access to the GPU resources
like our Word using hashcat,
directly on Windows as an example.
So it's actually gonna be slower here
than using a very powerful GPU with hashcat.
But there you go, it's created the wordlist,
there it is, mywordlist3.txt,
that's the one that we specified, I'll clear the screen.
Less mywordlist3.txt.
You can see it starts with lowercase single characters,
then it goes to uppercase single characters,
then lowercase double characters
and then it's mixing them upper and lower,
mixing with numbers,
so we've got all the various combinations
from one character and if I go to the end,
to five characters.
So as an example here, four nines, uppercase K,
here we've got five nines.
Scrolling up, you can see it's going through
all those different combinations.
Now, I don't wanna bore you,
but hopefully, you get the idea.
Crunch has created all the different combinations
in this file, going right to the beginning and there we go.
So once again, that was from one to five.
And this is just a matter of time,
so if I wanna go through all those combinations,
but I want it from eight to eight,
this is gonna be a much bigger file.
Notice this is a petabyte of data.
So I'm gonna stop that now
because that's just gonna take a long, long time
to generate that file.
You need to be careful with the sizes of files
that you create, so I'll stop that at this point.
Notice it ended at this point in the file,
so it got to that point and then stopped.
That's gonna take a long time to create
and it's gonna create a huge amount of data.
This is why the pre-built wordlists in Kali
are sometimes better, because they are actual passwords,
rather than just trying to try every single combination
to crack a password.
This is brute force, it's clunky,
it's just trying every single combination
with a hope that you'll find the correct password.
Now crunch does once again have a lot of options.
I suggest that you look at the manual,
because you can use special types of characters
such as these to indicate a lowercase or uppercase
or insert numbers, or insert symbols.
So as an example here,
I've got four different character types.
I'm gonna push that into wordlist4.
Notice I've specified these special characters,
so if I type less mywordlist5,
I see all the different types of characters
that can be used.
So this includes uppercase, lowercase digits,
as well as special characters in the password.
So if I once again, look at the Man file,
this is lowercase, uppercase, numbers and symbols.
Crunch has a lot of examples in the documentation,
so again, have a look at the documentation for more options.
I don't wanna make this video too long
and show you all kinds of weird options,
just note that crunch gives you a whole bunch of options
to create passwords.
But again, you may prefer using a list like rockyou,
which are actual passwords that people have used
in the real world, rather than just creating a dictionary
or wordlist of all kinds of passwords
and using a brute-force attack.
Okay, I hope you enjoyed this video.
If you did, please consider subscribing
to my YouTube channel.
Please like this video and click on the bell
to get notifications.
I'm David Bombal, wanna wish you all the very best.
(upbeat music)