P4ssw0rds!!!!111 by Richard Hicks

## Overview Richard Hicks (scriptmonkey) presents practical guidance on password cracking methodology, drawing from his experience managing password cracking infrastructure for a large security consultancy. The talk emphasizes that effective password cracking requires intelligent optimization rather than brute-force dictionary attacks against large wordlists.

## Key Technical Issues Hicks outlines common mistakes made by penetration testers: - Incorrect hashcat command-line parameters, such as swapping hash and wordlist ordering or using wrong hashing algorithm codes (e.g., confusing 5600 with 1000) - Failing to optimize hashcat settings: work profile (-w) affects speed dramatically (e.g., w1 vs w4 yields ~2x performance difference); the -o (optimized kernel) flag provides massive speed gains for faster hashes - Running algorithms like bcrypt exhaustively when they would require 41,000 years to complete, when dictionary approaches would be more efficient - Testing with bcrypt at 80 hashes per second means guessing patterns like seasons/years from the 1990s wastes significant computational time

## Dictionary and Wordlist Optimization Hicks emphasizes curating wordlists intelligently: - Public dumps like rockyou.txt (1.1 billion words, 13GB) contain garbage: HTML tags, non-printable Unicode characters, and duplicates - The word "password" appears at position 168 million in rockyou.txt and 891 million in crackstation, meaning millions of wasted guesses before testing common passwords - Custom, targeted dictionaries for specific clients/targets yield better results than massive generic lists - Bigger wordlists are not always better; filtering for context (e.g., avoiding curse words in corporate guest WiFi passwords) saves computational resources

## Locale and Deduplication Problems Character encoding (locale) significantly impacts wordlist sorting and deduplication. Locale must be set correctly (e.g., LC_ALL=C) before sorting or tools will behave unpredictably. Memory management is critical: sorting massive wordlists can trigger the OOM killer. Hicks demonstrates splitting rockyou.txt into 100 files of ~11 million lines each to avoid memory exhaustion. Tools like rling (remove line ng) enable deduplication across multiple files and removal of duplicates within the consolidated wordlist.

## Hashcat Optimization and Masks Mask-based attacks are more efficient than pure dictionary approaches for structured passwords. Hicks explains: - Custom masks (e.g., ?l?d?s for lowercase-digit-special) can be defined with -1, -2, etc. - Hashcat provides predefined character sets for common languages - Hybrid attacks (-6 for prefix, -7 for suffix) combine masks with dictionary words - The --increment flag tests all password lengths, not just a fixed length - Forgetting to specify a mask in attack mode 3 defaults to 50-character passwords, wasting hours - Statistical analysis using PACK (Password Analysis and Cracking Toolkit) generates optimal masks from previously cracked passwords

## Hash Identification When hash type is unknown, hashcat's --identify function tests hashes against all supported parsers. mdxfind (by waffle/synoprime) is a CPU-bound tool supporting 500+ algorithms in parallel. It can identify nested hashing (e.g., MD5 inside SHA-256) and handles variants like truncated SHA or reversed hashes.

## Key Recommendations - Split large wordlists before sorting to avoid OOM - Deduplicate wordlists both internally and across sources - Set locale (LC_ALL=C) before sorting - Maintain curated, clean wordlists organized alphabetically for reuse - Use symlinks and glob patterns to prioritize custom dictionaries over massive public lists - Analyze successfully cracked passwords using statsgen/mask generator to refine future attacks - Optimize hashcat via work profiles and optimized kernel flags - Apply context-aware filtering to wordlists before cracking

## Resources Cited Hashcat forums, netbooks.com (books on hash cracking), blog.synoprime.com, wpa7.org (WPA2 handshake dictionaries), PACK toolkit, rling, leaky.pipe (leet speak mutations), and Twitter accounts of password cracking practitioners (win-xp-5421, stealth-floyd, synoprime).