linux - hashcat-大小写字典攻击(区分大小写)

有人 hashcat - advanced password recovery Usage: hashcat - [ Options ] - Options Short / Long ======================= -m, --hash-type -a, --attack-mode -V, --version -h, --help --quiet --hex-charset --hex-salt --hex-wordlist --force --status --status-timer --stdin-timeout-abort --machine-readable --keep-guessing --self-test-disable --loopback --markov-hcstat2 --markov-disable --markov-classic -t, --markov-threshold --runtime --session --restore --restore-disable --restore-file-path -o, --outfile --outfile-format --outfile-autohex-disable | --outfile-check-timer --wordlist-autohex-disable | -p, --separator --stdout --show --left --username --remove --remove-timer --potfile-disable --potfile-path --encoding-from --encoding-to --debug-mode --debug-file --induction-dir --outfile-check-dir --logfile-disable --hccapx-message-pair --nonce-error-corrections --keyboard-layout-mapping --truecrypt-keyfiles --veracrypt-keyfiles --veracrypt-pim -b, --benchmark --benchmark-all --speed-only --progress-only -c, --segment-size --bitmap-min --bitmap-max --cpu-affinity --example-hashes -I, --opencl-info --opencl-platforms -d, --opencl-devices -D, --opencl-device-types --opencl-vector-width -O, --optimized-kernel-enable | -w, --workload-profile -n, --kernel-accel -u, --kernel-loops -T, --kernel-threads --spin-damp --hwmon-disable --hwmon-temp-abort --scrypt-tmto -s, --skip -l, --limit --keyspace -j, --rule-left -k, --rule-right -r, --rules-file -g, --generate-rules --generate-rules-func-min --generate-rules-func-max --generate-rules-seed -1, --custom-charset1 -2, --custom-charset2 -3, --custom-charset3 -4, --custom-charset4 -i, --increment --increment-min --increment-max -S, --slow-candidates --brain-server -z, --brain-client --brain-client-features --brain-host --brain-port --brain-password --brain-session --brain-session-whitelist - [ Brain Client Features ] - # | Features ===+======== 1 | Send hashed passwords 2 | Send attack positions 3 | Send hashed - [ Outfile Formats ] - # | Format ===+======== 1 | hash[:salt] 2 | plain 3 | hash[:salt]:plain 4 | hex_plain 5 | hash[:salt]:hex_plain 6 | plain:hex_plain 7 | hash[:salt]:plain:hex_plain 8 | crackpos 9 | hash[:salt]:crack_pos 10 | plain:crack_pos 11 | hash[:salt]:plain:crack_pos 12 | hex_plain:crack_pos 13 | hash[:salt]:hex_plain:crack_pos 14 | plain:hex_plain:crack_pos 15 | hash[:salt]:plain - [ Rule Debugging Modes ] - # | Format ===+======== 1 | Finding-Rule 2 | Original-Word 3 | Original-Word:Finding-Rule 4 | Original-Word:Fin - [ Attack Modes ] - # | Mode ===+====== 0 | Straight 1 | Combination 3 | Brute-force 6 | Hybrid Wordlist + Mask 7 | Hybrid Mask + Wordlist - [ Built-in Charsets ] - ? | Charset ===+========= l | abcdefghijklmnopqrstuvwxyz u | ABCDEFGHIJKLMNOPQRSTUVWXYZ d | 0123456789 h | 0123456789abcdef H | 0123456789ABCDEF s | !"#$%&&# a | ?l?u?d?s b | 0x00 - 0xff - [ OpenCL Device Types ] - # | Device Type ===+============= 1 | CPU 2 | GPU 3 | FPGA, DSP, Co-Processor - [ Workload Profiles ] - # | Performance ===+=============+==== 1 | Low 2 | Default 3 | High 4 | Nightmare - [ Basic Examples ] - Attack- | Hash- | Mode ==================+=== Wordlist Wordlist + Rules | MD5 Brute-Force Combinator If you still have * https://hashcat.net/w * https://hashcat.net/faq/ kali@kali:~$
谢谢

Closed. This question does not meet Stack Overflow guidelines。它当前不接受答案。

想改善这个问题吗？更新问题，以便将其作为on-topic用于堆栈溢出。

在10个月前关闭。

Improve this question

我是计算机安全的新手，但我正在尝试从字典密码开始进行切换大小写攻击的操作。

我读过there，可以从字典开始交替使用大写和小写单词来具有所有组合(区分大小写)。

我不知道要使用什么命令，现在我在标准字典攻击中停止了4

sudo hashcat -m 16800 convertedpcap.16800 dict.txt 知道怎么做吗？

这里是完整的帮助(我删除了[[哈希模式]-以节省空间):
kali@kali:~$ hashcat --help [options]... hash|hashfile|hccapxfile [dictionary|mask|directory]... | Type | Description                                          | Example =========+======+======================================================+======================= | Num  | Hash-type, see references below                      | -m 1000 | Num  | Attack-mode, see references below                    | -a 3 |      | Print version                                        | |      | Print help                                           | |      | Suppress output                                      | |      | Assume charset is given in hex                       | |      | Assume salt is given in hex                          | |      | Assume words in wordlist are given in hex            | |      | Ignore warnings                                      | |      | Enable automatic update of the status screen         | | Num  | Sets seconds between status screen updates to X      | --status-timer=1 | Num  | Abort if there is no input from stdin for X seconds  | --stdin-timeout-abort=300 |      | Display the status view in a machine-readable format | |      | Keep guessing the hash after it has been cracked     | |      | Disable self-test functionality on startup           | |      | Add new plains to induct directory                   | | File | Specify hcstat2 file to use                          | --markov-hcstat2=my.hcstat2 |      | Disables markov-chains, emulates classic brute-force | |      | Enables classic markov-chains, no per-position       | | Num  | Threshold X when to stop accepting new markov-chains | -t 50 | Num  | Abort session after X seconds of runtime             | --runtime=10 | Str  | Define specific session name                         | --session=mysession |      | Restore session from --session                       | |      | Do not write restore file                            | | File | Specific path to restore file                        | --restore-file-path=x.restore | File | Define outfile for recovered hash                    | -o outfile.txt | Num  | Define outfile-format X for recovered hash           | --outfile-format=7 | Disable the use of $HEX[] in output plains           | | Num  | Sets seconds between outfile checks to X             | --outfile-check=30 | Disable the conversion of $HEX[] from the wordlist   | | Char | Separator char for hashlists and outfile             | -p : |      | Do not crack a hash, instead print candidates only   | |      | Compare hashlist with potfile; show cracked hashes   | |      | Compare hashlist with potfile; show uncracked hashes | |      | Enable ignoring of usernames in hashfile             | |      | Enable removal of hashes once they are cracked       | | Num  | Update input hash file each X seconds                | --remove-timer=30 |      | Do not write potfile                                 | | File | Specific path to potfile                             | --potfile-path=my.pot | Code | Force internal wordlist encoding from X              | --encoding-from=iso-8859-15 | Code | Force internal wordlist encoding to X                | --encoding-to=utf-32le | Num  | Defines the debug mode (hybrid only by using rules)  | --debug-mode=4 | File | Output file for debugging rules                      | --debug-file=good.log | Dir  | Specify the induction directory to use for loopback  | --induction=inducts | Dir  | Specify the outfile directory to monitor for plains  | --outfile-check-dir=x |      | Disable the logfile                                  | | Num  | Load only message pairs from hccapx matching X       | --hccapx-message-pair=2 | Num  | The BF size range to replace AP's nonce last bytes   | --nonce-error-corrections=16 | File | Keyboard layout mapping table for special hash-modes | --keyb=german.hckmap | File | Keyfiles to use, separated with commas               | --truecrypt-keyf=x.png | File | Keyfiles to use, separated with commas               | --veracrypt-keyf=x.txt | Num  | VeraCrypt personal iterations multiplier             | --veracrypt-pim=1000 |      | Run benchmark of selected hash-modes                 | |      | Run benchmark of all hash-modes (requires -b)        | |      | Return expected speed of the attack, then quit       | |      | Return ideal progress step size and time to process  | | Num  | Sets size in MB to cache from the wordfile to X      | -c 32 | Num  | Sets minimum bits allowed for bitmaps to X           | --bitmap-min=24 | Num  | Sets maximum bits allowed for bitmaps to X           | --bitmap-max=24 | Str  | Locks to CPU devices, separated with commas          | --cpu-affinity=1,2,3 |      | Show an example hash for each hash-mode              | |      | Show info about detected OpenCL platforms/devices    | -I | Str  | OpenCL platforms to use, separated with commas       | --opencl-platforms=2 | Str  | OpenCL devices to use, separated with commas         | -d 1 | Str  | OpenCL device-types to use, separated with commas    | -D 1 | Num  | Manually override OpenCL vector-width to X           | --opencl-vector=4 | Enable optimized kernels (limits password length)    | | Num  | Enable a specific workload profile, see pool below   | -w 3 | Num  | Manual workload tuning, set outerloop step size to X | -n 64 | Num  | Manual workload tuning, set innerloop step size to X | -u 256 | Num  | Manual workload tuning, set thread count to X        | -T 64 | Num  | Use CPU for device synchronization, in percent       | --spin-damp=50 |      | Disable temperature and fanspeed reads and triggers  | | Num  | Abort if temperature reaches X degrees Celsius       | --hwmon-temp-abort=100 | Num  | Manually override TMTO value for scrypt to X         | --scrypt-tmto=3 | Num  | Skip X words from the start                          | -s 1000000 | Num  | Limit X words from the start + skipped words         | -l 1000000 |      | Show keyspace base:mod values and quit               | | Rule | Single rule applied to each word from left wordlist  | -j 'c' | Rule | Single rule applied to each word from right wordlist | -k '^-' | File | Multiple rules applied to each word from wordlists   | -r rules/best64.rule | Num  | Generate X random rules                              | -g 10000 | Num  | Force min X functions per rule                       | | Num  | Force max X functions per rule                       | | Num  | Force RNG seed set to X                              | | CS   | User-defined charset ?1                              | -1 ?l?d?u | CS   | User-defined charset ?2                              | -2 ?l?d?s | CS   | User-defined charset ?3                              | | CS   | User-defined charset ?4                              | |      | Enable mask increment mode                           | | Num  | Start mask incrementing at X                         | --increment-min=4 | Num  | Stop mask incrementing at X                          | --increment-max=8 |      | Enable slower (but advanced) candidate generators    | |      | Enable brain server                                  | |      | Enable brain client, activates -S                    | | Num  | Define brain client features, see below              | --brain-client-features=3 | Str  | Brain server host (IP or domain)                     | --brain-host=127.0.0.1 | Port | Brain server port                                    | --brain-port=13743 | Str  | Brain server authentication password                 | --brain-password=bZfhCvGUSjRq | Hex  | Overrides automatically calculated brain session     | --brain-session=0x2ae611db | Hex  | Allow given sessions only, separated with commas     | --brain-session-whitelist=0x2ae611db passwords and attack positions :hex_plain:crack_pos ding-Rule:Processed-Word 39;()*+,-./:;<=>?@[\]^_`{|}~ | Runtime | Power Consumption | Desktop Impact =====+===================+================= |   2 ms  | Low               | Minimal |  12 ms  | Economic          | Noticeable |  96 ms  | High              | Unresponsive | 480 ms  | Insane            | Headless | Type  | Example command ====+================================================================== | $P$   | hashcat -a 0 -m 400 example400.hash example.dict | hashcat -a 0 -m 0 example0.hash example.dict -r rules/best64.rule | MD5   | hashcat -a 3 -m 0 example0.hash ?a?a?a?a?a?a | MD5   | hashcat -a 1 -m 0 example0.hash example.dict example.dict no idea what just happened, try the following pages: iki/#howtos_videos_papers_articles_etc_in_the_wild
                                    最佳答案            
            
            简短答案:

从Github上的Hashcat存储库下载toggle5.rule并尝试运行以下命令:
sudo hashcat -m 16800 -r toggle5.rule convertedpcap.16800 dict.txt

hashcat规则说明和演示:

使用旧的切换案例示例链接到newer article推荐规则，特别是rules/中的示例。对于此示例，让我们使用toggle5.rule，该站点解释为“一次包含所有可能的明文位置1到15到... 5个字符的切换选项”。

让我们尝试破解字符串HaShCaT的md5并将其放入我们的example.hash文件(它是41e24266141b6ef98bf0e1fb54b238a1)中，并使用仅字符串hashcat的字典作为example.dict文件。继续使用您喜欢的编辑器在您正在使用的任何文件夹中创建这两个文件。

如果我们只是使用普通的字典攻击，就像这样:
hashcat -a 0 -m 0 example.hash example.dict

它无法破解哈希。没有惊喜。现在添加--stdout标志。
hashcat --stdout -a 0 -m 0 -r toggle5.rule example.dict

您将看到打印出的哈希值，然后是如果我们尝试破解哈希值将要尝试的所有候选对象，在这种情况下，它只是字符串hashcat。注意，使用--stdout时，命令中不需要example.hash。

现在让我们尝试将toggle5.rule添加到
hashcat --stdout -a 0 -m 0 -r toggle5.rule example.dict

我直接从Github存储库复制了规则。多亏了--stdout，它应该在hashcat上打印一个很多变体形式。我们可以通过将其通过less或更好的管道进行管理，使其更加易于管理。
hashcat --stdout -a 0 -m 0 -r toggle5.rule example.dict | sort | uniq -c | sort -rn

基本上，这将显示hashcat的每个变体作为候选者生成的次数。现在，您将看到规则如何为尝试破解哈希生成新的候选者!然后，最终运行...
hashcat -a 0 -m 0 -r toggle5.rule example.hash example.dict

和成功!它破解了md5哈希HaShCaT。

现在关于您的问题...

专门针对您所要询问的内容，您可能不需要toggle5.rule提供的所有变体。如果您确定要破解的密码少于15个字符或最多包含4个大写字符，则可以减少变体形式。

例如，如果您只想尝试对每个字母使用交替大小写的候选词，则规则文件将是
T0T2T4T6T8TATCTE
T1T2T5T7T9TBTDTF

以hashcat为例，这将生成候选HaShCaT和hAsHcAt。以防万一这更接近您要寻找的东西。请随时在评论中描述您的特定情况，我们可以共同探讨最有意义的规则。
关于linux - hashcat-大小写字典攻击(区分大小写)，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/60860764/