Perhaps this is obvious to everyone else, but it isn't noted in the documentation (as far as I can find), and it caught me off guard. I've been running a lot of mask files against a particular WPA handshake, and now I'll need to go back and revise several.
So, as a PSA for anyone else who might be conducting similar sessions:
-- performing mask attacks
-- with the increment switch
-- anchor text on the back end (right side)
For example:
Passkey: 123April
I was expecting it to increment against the anchor text, e.g.:
But instead it works left to right, and the incrementation includes the anchor text:
Therefore, the mask would fail to find the passkey "123April". And since it increments through the anchor text, it also takes significantly longer to run each mask.
This isn't the situation when the anchor text and the mask is flipped.
e.g. if the command is:
It does this:
not this:
(or whatever)
The workaround is to just put "April" in a dictionary file and use attack mode 7 instead:
Works as expected - "123April" is recovered.
That's all fine. I've just been doing a lot of mask attacks on the fly as I think of new keyword sets, and I'll dump them in a mask file, e.g.:
?d?d?d?d?d-jan
jan-?d?d?d?d?d
?d?d?d?d?d-texas
texas-?d?d?d?d?d
etc. etc.
Start the attack, walk away, check back when it's done. So it took me a while to catch this on my own.
So, as a PSA for anyone else who might be conducting similar sessions:
-- performing mask attacks
-- with the increment switch
-- anchor text on the back end (right side)
For example:
Passkey: 123April
Code:
-a 3 -i hashfile.txt ?d?d?d?d?dAprilI was expecting it to increment against the anchor text, e.g.:
Code:
12333April
1233April
123April
12April
1AprilBut instead it works left to right, and the incrementation includes the anchor text:
Code:
1
12
123
1233
12333
12333A
12333Ap
12333Apr
12333Apri
12333AprilTherefore, the mask would fail to find the passkey "123April". And since it increments through the anchor text, it also takes significantly longer to run each mask.
This isn't the situation when the anchor text and the mask is flipped.
e.g. if the command is:
Code:
-a 3 -i hashfile.txt April?d?d?d?d?dIt does this:
Code:
April1
April12
April123
April1233
April12333not this:
Code:
A
A1
A12
A123
A1233
A12333
Ap1
Ap12(or whatever)
The workaround is to just put "April" in a dictionary file and use attack mode 7 instead:
Code:
-a 7 -i hashfile.txt ?d?d?d?d?d april.txtWorks as expected - "123April" is recovered.
That's all fine. I've just been doing a lot of mask attacks on the fly as I think of new keyword sets, and I'll dump them in a mask file, e.g.:
?d?d?d?d?d-jan
jan-?d?d?d?d?d
?d?d?d?d?d-texas
texas-?d?d?d?d?d
etc. etc.
Start the attack, walk away, check back when it's done. So it took me a while to catch this on my own.