hashcat / hashcat-utils

Small utilities that are useful in advanced password cracking
MIT License
1.36k stars 355 forks source link

Why Combinator is not making all possible combinations? #33

Closed Flix666 closed 7 years ago

Flix666 commented 7 years ago

Hi,

I made three wordlists: 12345 (885 lines/words), qaz (16 lines), wsx (16 lines).

First I combine qaz with wsx (result: qazwsx)

Combining 12345 with qazwsx is giving me wordlist with 226560 lines (correct)

Also using combinator3 combining 12345 with qaz and with wsx is giving me wordlist with 226560 lines (correct)

But when I first combine 12345 with qaz (result 12345qaz (14160 lines, correct))

And then combine 12345qaz with wsx I got wordlist with only 226048 lines (512 lines missing).

Can someone explain me why I'm getting two different results (they should be exactly the same)

Is there any restriction in single password length? I noticed that Combiner is dropping passwords when they are longer than 36 signs.

I've attached the three base wordlist.

12345.txt missing lines.txt qaz.txt wsx.txt

Xanadrel commented 7 years ago

It's just in the source : https://github.com/hashcat/hashcat-utils/blob/0469d0e5922bad18bbee41138405ec708e7bf084/src/combinator.c#L14

Line length limit is set to 32, if you change the order of your files it works because at step 2 all lines are under 32 characters :

$ ./combinator3.exe qaz.txt wsx.txt 12345.txt > combi3.out

$ ./combinator.exe qaz.txt wsx.txt > combi.step1.out
$ ./combinator.exe combi.step1.out 12345.txt > combi.step2.out

$ sort -u -o combi3.out combi3.out
$ sort -u -o combi.step2.out combi.step2.out

$ wc -l *.out
    256 combi.step1.out
 226560 combi.step2.out
 226560 combi3.out
 453376 total

$ md5sum.exe *.out
1a5c439c15b44f8217420f6455d3aaf6 *combi.step1.out
add1e0561949f11082517f70cd43f206 *combi.step2.out
add1e0561949f11082517f70cd43f206 *combi3.out

You can also easily increase the limit and recompile depending on your needs :)

Wikinaut commented 4 years ago

I would like to propose the increasement of this value to, for example, 256. Would you accept such a regular pull request?