sean-t-smith / Extreme_Breach_Masks

A set of prioritized Hashcat .hcmask files intelligently developed from terabytes of password breach datasets and organized by run time.
https://www.seantsmith.me
111 stars 13 forks source link

Optimizations #2

Closed whoot closed 1 year ago

whoot commented 1 year ago

Since passwords with a character length up to 7 can easily be brute-forced (you also mention this in the Readme) and most of the time you have some kind of password policy in place, it makes sense to optimize the mask files even more. Here is what I did.

Delete all masks up to length 7 or masks which contain only 1 type of character, since they can easily be brute-forced or are not used very frequently.

find . -type f -name "*.hcmask" -exec sed -ri '/^((\?d){1,20}|(\?u){1,20}|(\?l){1,20}|(\?s){1,20}|(\?[ulds]){1,7})$/d' {} +
find . -type f -empty -print -delete

In insanity_7-16.hcmask.7z I just deleted the 7 character long passwords and renamed it to insanity_8-16.hcmask.7z

find . -type f -name "*.hcmask" -exec sed -ri '/^((\?[ulds]){1,7})$/d' {} +

Finally, password policy compliant files have been generated out of all masks in one folder, so the keyspace is from 8 to 16 characters. Those masks must contain at least 1 lower and 1 upper and either 1 digit or 1 special character:

grep -Ph "(?=.*[l])(?=.*[u])((?=.*d)|(?=.*s))" *.hcmask | sudo /opt/duplicut/duplicut -o X_policy.hcmask