Attachments

Related information

Researchers

• Andres Blanco

Tools

Nueva version de esta magnifica herramienta SHA1 Checksum: 2ebec75c3979daa7b576bc54adedc60eb0e27a21 Descarga: reaver 1.4

Fuente: openwips-ng.org OpenWIPS-ng es open-source y modular Wireless IPS (Intrusion Prevention System). Se compone de tres partes: Sensor (s): “Dumb”, dispositivos que capturan el tráfico inalámbrico y lo envian al servidor para su análisis. También responde a los ataques. Servidor: Agregados los datos de todos los sensores, analizar y responder a los ataques. También registra y alerta en caso de un ataque. Interfaz: interfaz gráfica de usuario para administrar el servidor y mostrar información sobre las amenazas de la red inalámbrica (s). Descarga: openwips-ng-0.1beta1.tar.gz Videos: [youtube_sc url=”http://www.youtube.com/watch?feature=player_embedded&v=4md3UeV0UWU”]

Fuente original http://code.google.com/p/reaver-wps/wiki/README Autor traduccion: gpain Zona de Descarga http://code.google.com/p/reaver-wps/downloads/list Ultima version http://reaver-wps.googlecode.com/files/reaver-1.3.tar.gz SHA1 Checksum:    408a4d4cd5051d290a68c140d3351acbf32dc4a7 Incluido en wifiway 3.4, unica live del mundo que lo incorpora de serie DESCARGA OFICIAL: http://download.wifislax.com/wifiway-3.4.iso MD5: 3e0645da12d5bbbdb4dd335c891e2866 Observaciones Puedes copiar este manual en todos los sitios que deseis, solo pedimos que por favor mantengais el autor de la traduccion gpain Resumen Reaver lleva a cabo un ataque de fuerza bruta contra el número pin de la configuración protegida del punto de acceso wifi. Una vez que el pin WPS es encontrado, la WPA PSK puede ser recuperada y alternativamente la configuración inalámbrica del AP puede ser reconfigurada. Aunque reaver no soporta la reconfiguración del AP, se puede conseguir con el wpa_supplicant una vez el pin WPS es conocido. DESCRIPCIÓN Reaver tiene como objectivo la funcionalidad externa de “registrador” requerida por la especificación de configuración inalámbrica protegida. Los puntos de acceso proveerán “registradores” autenticados con su configuración inalámbrica actual (incluyendo la WPA PSK), y también aceptaran una nueva configuración del registro. Con el fin de autenticarse como “registrador”, el “registrador” debe probar su conocimiento del número pin de 8 dígitos del AP. Los “registradores” deberían autenticarse a sí mismos al AP sin importar cuando sin la interacción del usuario. A causa de que el protocolo WPS es conducido sobre EAP, el “registrador” sólo necesita estar asociado con el AP y ningún conocimiento previo del cifrado inalámbrico o de la configuración. Reaver lleva acabo un ataque de fuerza bruta contra el AP, probando cada posible combinación para adivinar el número pin de 8 dígitos del AP. Desde que los números pin son entéramente numéricos, hay 10^8 (100.000.000) posibles valores para cualquier número pin. Sin embargo, como el último dígito del pin es un valor checksum (de comprobación) que puede ser calculado en base a los 7 dígitos previos, la posibles claves son reducidas a 10^7 (10,000,000) valores posibles. Las posibles llaves son reducidas incluso más debido al hecho de que el protocolo de autentificación WPS corta el pin por la mitad y valida cada mitad individualmente. Eso significa que hay 10^4 (10.000) posibles valores para la primera mitad del pin y 10^3 (1.000) posibles valores para la segunda mitad del pin, contando el último dígito de comprobación del pin. Reaver hace fuerza bruta a la primera mitad del pin y luego a la segunda mitad, provocando que todos los posibles valores del número pin del WPS puedan ser puedan ser agotados en 11.000 intentos. La velocidad a la que Reaver puede probar los números pin está totalmente limitada por la velocidad a la que el AP puede procesar peticiones WPS. Algunos APs son suficientemente rápidos para que se pueda probar un pin cada segundo; otros son mas lentos y solo permiten un pin cada 10 segundos. Estadísticamente, sólo llevara la mitad del tiempo adivinar el número pin correcto. INSTALACIÓN Reaver sólo está soportado en la plataforma linux, requiere las librerias libpcap y libsqlite3, y puede ser construido e instalado ejecutando: Para desinstalar todo lo instalado/creado por Reaver: USO Habitualmente, el único argumento requerido para Reaver es el nombre de la interfaz y el BSSID del AP objetivo: El canal y SSID (teniendo en cuenta que el SSID no esta encubierto) del AP objetivo son identificados automáticamente por Reaver, a menos que se especifique explícitamente en la línea de comando: Por defecto, si el AP cambia canales, Reaver también cambiará su canal en consecuencia. Sin embargo, está característica puede ser desactivada “fijando” el canal de la interfaz. El tiempo de espera de recepción por defecto es 5 segundos. Este tiempo de espera puede ser configurado manualmente si fuera necesario (el tiempo de espera mínimo es 1 segundo): El tiempo de retraso por defecto entre intentos de pin es de 1 segundo. Este valor puede ser incrementado o decrementado a cualquiera valor entero no negativo. Un valor de cero significa sin retraso: Algunos APs bloquearán temporálmente su estado WPS, normalmente durante 5 minutos o menos, cuando es detectada actividad “sospechosa”. Por defecto cuando se detecta un estado bloqueado, Reaver comprobará el estado cada 315 segundos (5 minutos y 15 segundos) y no continuará haciendo fuerza bruta a los pins hasta que el estado del WPS esté desbloqueado. Esta comprobación puede ser incrementada o decrementada a cualquier valor entero no negativo: Para salidas adicionales, se debe proporcionar la opción “verbose”. Proporcionando la opción “verbose” dos veces se incrementará el nivel de detalle y se mostrará cada número pin intentado. El tiempo de espera por defecto para recibir los mensajes de respuesta del WPS M5 y M7 es .1 segundos. Este tiempo de espera puede ser fijado manualmente si fuese necesario (tiempo de espera máximo 1 segundo). Algunas implementaciones WPS pobres tirarán la conexión, cuando se suministre un pin inválido en vez de responder con un mensaje NACK como dicen las especificaciones. Teniendo en cuenta esto, si se alcanza el tiempo de espera de mensaje M5/M7, es tratado por defecto como un NACK. Sin embargo, si se sabe que el AP envía NACKS (la mayoría lo hacen), esta característica puede ser desactivada para mayor exactitud. Esta opción está ampliamente en desuso ya que Reaver autodetectará si un AP responde adecuadamente con NACKs o no: Aunque a la mayoría de los APs no les importa, enviar un mensaje EAP FAIL para cerrar una sesión WPA es necesario a veces. Por defecto esta característica esta deshabilitada, pero puede habilitarse para aquellos APs que la necesiten. Cuando se encuentran 10 errores WPS consecutivos no esperados, se mostrará un mensaje de advertencia. Cómo esto es una señal de que el AP está limitado el ratio de intentos del pin o simplemente siendo desbordado, se fijará una pausa cuando aparezcan estos mensajes: ARCHIVOS Lo siguiente son archivos fuente de Reaver: 80211.c Funciones para leer, enviar y analizar trazas de gestión 802.11 builder.c Funciones para construir paquetes y paquetes de encabezado config.h Generado por el script de configuración cracker.c Funciones principales de crackeo para Reaver. defs.h Encabezados comunes con la mayoría de las declaraciones y definiciones requeridas. exchange.c Funciones para iniciar y procesar el intercambio WPS. globule.c Funciones de contenedor para acceder a los ajustes globales. iface.c Funciones de la interfaz de red. init.c Funciones de inicialización. keys.c Contiene tablas de todos los posibles pins. misc.c Conversión de direcciones mac, funciones de depurado, etc pins.c Generación de Pin y funcione de aleatoreidad. send.c Funciones para enviar mensajes de respuesta WPS sigalrm.c Funciones para el manejo de interrupciones SIGALRM sigint.c Funciones para el manejo de interrupciones SIGINT wpscrack.c Principal archivo fuente de Reaver wps.h Incluye funciones para wpa_supplicant libwps/ Generic Librería para analizar los elementos de información WPS Los siguientes archivos han sido cogidos de wpa_supplicant. Algunos han sido modificados a partir de sus originales. common/ crypto/ tls/ utils/ wps/ El directorio Iew contiene la version 29 de Wireless Tools, usada para interactuar con las extensiones inalámbricas de Linux.

WPS (Wi-Fi Protected Setup) es un estándar promovido por la Wi-Fi Alliance para la creación de redes WLAN seguras. En otras palabras, WPS no es un mecanismo de seguridad por sí, se trata de la definición de diversos mecanismos para facilitar la configuración de una red WLAN segura con WPA2, pensados para minimizar la intervención del usuario en entornos domésticos o pequeñas oficinas (SOHO). Concretamente, WPS define los mecanismos a través de los cuales los diferentes dispositivos de la red obtienen las credenciales (SSID y PSK) necesarias para iniciar el proceso de autenticación. WPS define una arquitectura con tres elementos con roles diferentes:

• Registrar: dispositivo con la autoridad de generar o revocar las credenciales en la red. Tanto un AP como cualquier otra estación o PC de la red pueden actuar de Registrar. Puede haber más de un Registrar en una red.
• Enrollee: dispositivo que solicita el acceso a la red WLAN.
• Authenticator: AP funcionando de proxy entre el Registrar y el Enrollee.

WPS contempla cuatro tipos de configuraciones diferentes para el intercambio de credenciales, PIN (Personal Identification Number), PBC (Push Button Configuration), NFC (Near Field Communications) y USB (Universal Serial Bus):

• PIN: tiene que existir un PIN asignado a cada elemento que vaya a asociarse a la red. Este PIN tiene que ser conocido tanto por el Registrar, como por el usuario (Enrollee). Es necesaria la existencia de una interfaz (e.g. pantalla y teclado) para que el usuario pueda introducir el mencionado PIN.
• PBC: la generación y el intercambio de credenciales son desencadenados a partir que el usuario presiona un botón (físico o virtual) en el AP (o en otro elemento Registrar) y otro en el dispositivo. Notar que en el corto lapso de tiempo entre que se presiona el botón en el AP y se presiona en el dispositivo, cualquier otra estación próxima puede ganar acceso a la red.
• NFC: intercambio de credenciales a través de comunicación NFC. La tecnología NFC, basada en RFID permite la comunicación sin hilos entre dispositivos próximos (0 – 20 cm). Entonces, el dispositivo Enrollee se tiene que situar al lado del Registrar para desencadenar la autenticación. De esta manera, cualquier usuario que tenga acceso físico al Registrar, puede obtener credenciales válidas.
• USB: con este método, las credenciales se transfieren mediante un dispositivo de memoria flash (e.g. pendrive) desde el Registrar al Enrollee.

Los métodos PBC, NFC y USB pueden usarse para configurar dispositivos sin pantalla ni teclado (e.g. impresoras, webcams, etc.), pero aunque el estándar contempla NFC y USB, todavía no se certifican estos mecanismos. Actualmente sólo el método PIN es obligatorio en todas las estaciones para obtener la certificación WPS; PBC es obligatorio sólo en APs.

Autor:  Mambostar ======================================= FULL DISCLOSURE – Seguridadwireless.net Fecha descubrimiento: 14/01/2012 Ultima revisión: 17/01/2012 Descubridor: Seguridadwireless.net =======================================

Presentación

Desde el grupo de Cifrados podemos confirmar que las redes WLAN_XXXX routers Observa Telecom 00:19:15:XX:XX:XX son vulnerables al ataque WPS y que el PIN por defecto es 12345670. con lo que la obtención de la clave WPA/WPA2 resulta trivial. En condiciones de buena recepción la clave se obtiene entre 10 y 71 segundos por las pruebas que hemos realizado. Gracias a todos los que han aportado datos y realizado las pruebas para sacar a la luz este nuevo.fallo de seguridad. Saludos Comentar

Fuente original PRE-INTRO Since the post on Creating wordlists with crunch v2.4 made in April last year, crunch has gone through quite a few changes and improvements and bofh28 has now released v3.0 ! (on 16-05-2011) To make sure that the information on this blog is staying upto date, its time for a new and improved post. There will be a lot of duplication from my previous post on crunch, but it should then at least be a more or less full and complete post. I have tried to follow the alphabetical order of the options and have done a chapter per option/switch. Please leave comments should the post be lacking information on anything you feel should be included. INTRODUCTION crunch is a tool for creating bruteforce wordlists which can be used to audit password strength. The size of these wordlists is not to be underestimated, however crunch can make use of patterns to reduce wordlist sizes, can compress output files in various formats and (since v2.6) now includes a message advising the size of the wordlist that will be created, giving you a 3 second window to stop the creation should the size be too large for your intended use. The full range of options is as follows ; -b  Maximum bytes to write per file, so using this option the wordlist to be created can be split into various sizes such as KB / MB / GB (must be used in combination with “-o START” switch) -c  Number of lines to write to output file, must be used together with “-o START” -e Specifies when crunch should stop early (crunch v3.1) -f  Path to the charset.lst file to use, standard location is ‘/pentest/passwords/crunch/charset.lst to be used in conjunction with the name of the desired charset list, such as ‘mixalpha-numeric-space’ -i  Inverts the output sequence from left-to-right  to  right-to-left (So instead of aaa, aab, aac, aad etc, output would be aaa baa caa daa) -l  When specifying custom patterns with the -t option, the -l switch allows you to identify which of the characters should be taken as a literal character instead of a place holder ( @,%^ ) -o  Allows you to specify the file name / location for the output, e.g. /media/flashdrive/wordlist.txt -p  Prints permutations of the words or characters provided in the command line. -q  Prints permutation of the words or characters found in a specified file -r  Resumes from a previous session, exact same syntax to be used followed by -r -s  Allows you to specify the starting string for your wordlist. -t  Allows you to specify a specific pattern to use. Probably one of the most important functions ! Place holders for fixed character sets are ; @   —  lower case alpha characters ,    —   upper case alhpa characters %   —  numeric characters ^    —  special characters (including space) -u  Supresses the output of wordlist size & linecount prior starting wordlist generation. -z  Adds support to compress the generation output, supports gzip, bzip & lzma All the below is done on backtrack 5, only tested on the 32bit versions. crunch is not installed by default on BT5 and as yet (22-05-2011) not yet in the repo’s. (When it does hit the repo’s I will amend this post to reflect installing from repo’s) so download from the source at ; http://sourceforge.net/projects/crunch-wordlist/ and install as follows; Edit 12-06-2011 crunch is now available in the BT repositories, so can download and install on backtrack5 simply by doing a ; The default installation directory / path for crunch in backtrack 5 is All the below examples are based on being in the crunch directory /pentest/passwords/crunch/ To run crunch from outside of crunch’s own directory use ; /pentest/passwords/crunch/crunch [min length] [max length] [ character set] [options] example from root directory; Basic usage is as follows to print to screen To write to file use the -o switch ; If no character set is defined, then crunch will default to using the lower case alpha character set; Also any desired character set can be enterered manually in the command line ; ./crunch 6 6 0123456789ABCDEF Certain characters will need escaping with a backslash \  ; Using the -b switch, we can tell crunch to create a wordlist which is split into multiple files of user-specified sizes. This must be done in conjunction with -o START. The size definition can be;  kb, mb, gb  or  kib, mib, gib kb, mb, and gb are based on the power of 10 (i.e. 1KB = 1000 bytes) kib, mib, and gib are based on the power of 2 (i.e. 1KB = 1024 bytes). The output files will be named after the first and last entry in the wordlists. To create a wordlist split into files of not more than 1mb; To create a wordlist split in files of no more than 100mb; To create a  wordlist split into files of no more that 10kb; To create a wordlist split into files of no more than 2gb; etc. etc. (ie. number of passphrases per file) Using the -c switch you can have crunch create wordlists which do not contain more than the specified number of lines. This must be used in conjunction with -o START. To create files containing no more than 200000 (200 thousand) lines (passphrases); ./crunch 6 6 0123456789 -c 200000 -o START To create files containing no more that 150000 (150 thousand) lines (passphrases); The output files will be named after the first and last entry in the wordlists. STOPPING CRUNCH WORDLIST GENERATION AT A PRE-DETERMINED TIME Crunch v3.1 is now also released (20-07-2011) and with it comes the new -e switch. This option allows you to specify when you want the wordlist generation to stop. So the below example will start creating the 6 character numeric wordlist, but will stop at 333333 ; ./crunch 6 6 -t %%%%%% -e 333333 Crunch also comes with fixed character sets in charset.lst which is included in the installation. (also found in directory /pentest/passwords/crunch/ ) This saves on the typing (and typoes) when dealing with standard character sets. To use the fixed characters sets, instead of typing in character sets manually in the command line, you can use the -f switch to specify which character set we want to use ; To use only upper case alpha characters; To use only numeric characters ; To use hexidecimal characters (with uppercase alpha values) ; To use lower case, uppercase, numeric & special characters (beware of the size ! Don’t try to save..lol..) ; etc. etc. Since v2.7 additional Swedish character support has also been added for our Swedish brethren, nicely contributed by Niclas Kroon. It should be noted that you can easily create your own custom charset by simply including a line in the same format. If you for instance know that your target has a certain medical condition known as 133tsp34k, and you have an idea of which letters/numbers are usually used (forum posts etc. etc.) , you could simply include an extra line such as ; 1337 = [4bcd3f9hijk1mn0pqr$7uvwxyz] Doubt the above is authentic enough, but I’m sure you get the idea. Then just run in crunch as you would any other charset; ./crunch 4 4 -f charset.lst 1337 See /pentest/passwords/crunch/charset.lst for all possibilities  / charsets currently included. Using the -i option will invert the direction in which the wordlist is created, from left-to-right  to  right-to-left. Note that this does not change the content of the created wordlist, it only changes the intial direction in which it is created. The -i option can also be used when character sets have been specified, either manually or using the pre-defined charsets. ./crunch 4 4 -f charset.lst ualpha -i or for instance for creating numeric wordlists in an alternative direction ; If you actually want the wordlist creation to start from the last letter in the alphabet and work backwards, or work backwards from the last digit in a 10 digit numeric sequence, then you would have to enter the charset manually ; Crunch can also  be used to create permutations for either ; > characters / words entered in the command line with the -p switch. > lines in a wordlist with the -q switch Although there is no min/max character setting, this still needs to be entered for both the -p and -q switch. Using the -p switch you can create permutations of characters or of all words entered in the command line. Creating permutations of letters (fun for anograms) ; Creating permutations of lists of words; ./crunch 1 1 -p bird cat dog As the -p switch can read the input on command line as being letters or words, it MUST be the last option used; If for instance trying to suppress the size output message using the -u switch and placing the -u switch last, crunch will see 2 words (abcd + -u) and so will only print out the 2 permutation possibilities as well as actually recognizing the -u switch ; ./crunch 1 1 -p abcd -u So to ensure the output is as expected, the -p switch MUST always be the last option, and the correct syntax with the above example would be ; Using the -q switch, you can create all possible permutations of words in a text file ; (as always, beware of the possible size ! This best done on a ‘focussed’ wordlist) As an example, create a small text file with 3 lines and then run crunch over it with the -q option; RESUMING WORDLIST CREATION AFTER CANCELLATION crunch allows a wordlist creation to be stopped and restarted, to do this we use the -r (resume) switch. For this to work we must type the exact same line followed with the -r switch ; Stop the creation with a Ctrl C, then restart with ; If the wordlist was started from a specific position (see below chapter) then when resuming the -s switch as well as input must be removed ; When using this method, the notification on %% complete will not be accurate. Also, when resuming, crunch will advise that it is generating xx amount of data and xx number of lines. This information will not be correct as the calculation process thinks it is resuming from a creation of an entire wordlist, whereas it is of course resuming from a wordlist with a certain startblock. The below picture probably explains it better.. After cancelling with a Ctrl C, resume would then be done with ; ./crunch 8 8 0123456789 -o test.txt -r If we want to start crunch from a specific position in the wordlist we want to create, we can use the -s switch to use a specific startblock as starting position for the wordlist. For instance, if you started creating a wordlist, but had to cancel and resume on a different disk or HDD space ran out. The temporary file that crunch uses for the wordlist creation is “START” located in the crunch directory You can check this temporary file for the last couple of entries to allow you to move/rename the temp file START and restart the wordlist creation without losing the work already done. example ; > Ctrl + C stopping the wordlist creation, > check the last couple of entries in the START temporary file ; > copy or rename the temporary file to a name of your liking; > restart the wordlist creation from the last noted entry in the temporary file; NOTE! crunch will overwrite START when it starts a new wordlist creation process, so be sure to rename START into whatever you want to ensure you don’t lose the work already done ! Of course using the starting block can be used for whatever reason, for instance if you are sure that you don’t need any list with numbers starting before 59999999 ; This is where crunch really shines, and in my humble opinion, the most powerful capability that crunch has to offer. With a minimum amount of information on known or expected patterns and/or possible characters in the passphrase, custom patterns can be created allowing to specify what to place where in the created passhprases. In doing so the size of the wordlist can be reduced significantly and the wordlist can be tailored to the target in a much more efficient way, which is always to be endeavoured ! To fix a pattern, we use the -t switch in crunch. There are fixed symbols used for certain character sets ; @ –> Lower case alpha values (or @ will read and print from a specified character set, see further down in post) ,  –> Upper case alpha values % –> Numeric values ^ –> Special characters including ‘space’ So if we want to create a 6 character, lower alpha wordlist and with a pre-fix of ‘dog’; or if we want ‘dog’ to be appended ; or have ‘dog’ bang in the middle ; Or ‘dog’ followed by an upper case alpha, number and symbol; Miscellaneous patterns We can also combine the various fixed character sets, for instance, if we want to create an 8 character wordlist with alpha, numeric and special characters in fixed positions; Using the fixed character sets you can quickly and easily make ‘quick’ wordlists for a single character set.. Creating a wordlist with only lower case; ./crunch 4 4 -t @@@@ only numeric; ./crunch 4 4 -t %%%% or only uppercase; ./crunch 4 4 -t ,,,, only special characters; And of course if certain positions and characters are known, it can all be mixed up ; ./crunch 9 9 -t %%DOG^^@@ We can also even go a step further and specify which range of characters should be used for each character type. In the below example ; lower alpha values to only be ;  abcdef upper alpha values to only be ;  ABCDEF numeric values to only be      ;  12345 special characters to only be  ;  @#$% We can then specify same by entering these values manually in the command line ; lower alpha — upper alpha — numeric — special characters If there is no specific character range to be used for the character set, then that position should be completed with a ‘+’ placeholder sign which signifies the usage of the complete standard character set for that set positon. (lower alpha — upper alpha — numeric — special characters) The below example is using ‘abcdef’ as lower alpha charset, the full upper case charset, ‘12345’as numeric charset and the full special character charset. Although in the above examples @ is used as fixed character set for lower case values, we can also use it to specify a manually chosen single set of all types of characters ; Remember that certain characters on some occasion require escaping, if in doubt, better to just do it. If you want to include a space in the charset, then enclose the charset in quotes ; (space at end of charset below) Creating telephone lists You can also use the -t switch to easily make lists of telephone numbers, so if for instance the telephone number is usually noted as for instance;  0131-321654, then you could easily create a wordlist of telephone numbers following that same example ; Or if the layout is different, for instance including a space such as “(01201) 111111” this is achieved by putting quotes on the -t pattern as follows (this to ensure that the space is included); Endless variations are possible. The possiblities crunch offers to create patterns with such detail give you many options to really fine-tune what you want placed where in your passphrase wordlist and thus reduce the size of your final wordlist. When you start manually defining what to place where with special characters, you will on some occasions need to to ‘escape’ characters to allow crunch to read them correctly. This is the case for for instance an exclamation mark ! ; will result in an error. In order to make it work correctly you must ‘escape’  the exclamation mark ; As some special characters are used to define character sets, this can cause some limitations when trying to fix positions of certain special characters. Such as wanting to use @ as a fixed character ; ./crunch 4 4 -t 012@ or ./crunch 4 4 -t 012\@ This will not fix the character ‘@’ but use it to provide lower case alpha values. To remedy this to some extent, since crunch v3.0, the new -l switch can be used to fix the literal character instead of having it refer to a place holder for a specific character set. This would now be accomplished by doing ; Other possibilities; etc. etc. Also, more than 1 placeholder character can be fixed as a literal character; Of course this in itself also has limitations as you are not able to to check for all possible lower case alpha values or passthrough a user defined charset with a fixed setting of the @ character. The below 2 examples will obviously only return 1 result as all the instances of the @ character will be fixed as a literal character. This is an issue that is being looked into and possibly a following update of crunch will have an answer. Of course there are workarounds for some part; if for instance you wanted a password list to start with “p@ss” followed by 4 characters of all possible lower case values, you could create a list of 4 characters; And then use ‘sed’ or ‘awk’ to place the word ‘p@ss’ in front of each line ; Using sed ; Using awk ; So with a bit of imagination and a couple of oneliners with sed or awk, you should still be able to create more or less what you want. edit 25-05-2011 bofh28 has informed me of another workaround which can be used. You can override the standard characters per placeholder setting by entering a different type of charset in a different position and then using the placeholder character for that position. Normally the 3rd position is for numeric values, however if you specify lower case values, it will use these characters, however you then do need to use the place holder for that position, in this example %. Confused ? You won’t be after this episode of .. 😉 ./crunch 8 8 + + abcdefghijklmnopqrstuvwxyz + -t p@ss%%%% -l @ Crunch can be used to pipe passwords through to programs such as aircrack / pyrit / cowpatty etc. Considering that crunch is now advising the estimated size of wordlists to be created following the command given as well as the wordcount, to have a seamless integration with piping, it is recommended to use the -u option to supress that information on size, wordcount etc.; Without using the -u command, it is possible that unexpected errors occur with some programs. Using the -u option will result in the creating of the wordlist directly instead of giving the 3 second delay during which the estimated wordlist size and wordcount is shown ; In examples only testing for 8 character numeric passwords ; aircrack ./crunch 8 8 -t %%%%%%%% -u | aircrack-ng -e SSID -w – /pathto/capfile.cap cowpatty ./crunch 8 8 -t %%%%%%%% -u | cowpatty -f – -r /pathto/capfile.cap -s SSID pyrit ./crunch 8 8 -t %%%%%%%% -u | pyrit -i – -r /pathto/capfile.cap -e ESSID attack_passthrough Output files can be compressed with crunch using the -z switch. Supported formats are; > gzip > bzip > lzma Crunch will first create the wordlist and will then compress the wordlist. Upon the finalisation of the wordlist creation, you will see the 100% being reached and the 100% denomination will continue to be printed until the compression is complete. So if you see a continuous ‘stream’ of 100%, don’t worry, the program is not hanging, the output file is simply being compressed. It had me guessing when I was testing a compression of a couple of gigabytes.. but I assure you it is the case. The best level of compression and thus the slowest is obtained with lzma. The quickest compression, with the lowest level of compression, is obtained with gzip. To unzip the created file ; gunzip test.txt.gz To decompress the created file ; To decompress the created file ;  

wlg: Word List Generator version: 0.5 coded by white_sheep site: http://www.marcorondini.eu - http://www.ihteam.net twitter: http://www.twitter.com/white__sheep

Option

 -h [ --help ] produce help message -v [ --version ] show version -r [ --credits ] show credits -e [ --extract ] arg set string to extract -c [ --compat ] arg set counter to compat -g [ --gen ] start wordlist generator -f [ --filename ] arg set filename -C [ --charset ] arg (=ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvwxyz0123456789"_-.,:;!%&/()=?'^*+][@) set charset -o [ --using_word ] using word -w [ --start_word ] arg set start word -W [ --end_word ] arg set end word -n [ --using_index ] using index -i [ --start_int ] arg (=0) set start counter -I [ --end_int ] arg (=0) set end counter -l [ --using_length ] using length -m [ --min_length ] arg (=0) set min word length -M [ --max_length ] arg (=0) set max word length 

extract function: return iteration number wlg -e ciao 15669092 compat function: return string about iteration number wlg -c 15669092 ciao gen function: generate wordlist • using word index wlg -g -o -w ciao ( infinite wordlist creation ) wlg -g -o -w ciao -W ciaoc ( wordlist between ciao and ciaoc ) • using iteration index wlg -g -n -i 10000000000000000000 ( infinite wordlist creation ) wlg -g -n -i 100 -I 123123123123( wordlist between 100 and 123123123123 iteration number ) • using word length wlg -g -l -m 1 ( infinite wordlist creation ) wlg -g -l -m 3 -M 8 ( wordlist with min length 1 and max length 8 )

Using file for output wlg -g -l -m 1 -f wl.txt Set charset wlg -g -l -m 1 -C 0123456789 -f wl.txt  

 

Source: https://github.com/whitesheep/wlg