Inthistutorialwewilldescribethemain

optionsofCrunch.Wewillexplainthebasic
operationandmostimportantoptionsofusing
Crunchtooltocreategeneratewordlists.
AboutCrunch
Crunchisatoolforcreatingbruteforcewordlistswhichcanbeusedtoauditpasswordstrength.
Thesizeofthesewordlistsisnottobeunderestimated,howevercrunchcanmakeuseof
patternstoreducewordlistsizes,cancompressoutputfilesinvariousformatsand(sincev2.6)
nowincludesamessageadvisingthesizeofthewordlistthatwillbecreated,givingyoua3
secondwindowtostopthecreationshouldthesizebetoolargeforyourintendeduse.
(Note:ForthePurposeofthistutorialBackBox(BasedonUbuntu)asOSandthelatest
installationpackagesofCrunchwillbeused)

DownloadInstallCrunch
DownloadoneofthelatestversionofCrunchforLinuxplatformsfromtheofficialsite.
Nextwewillextractthe.tar.gzfiletypingthefollowingcommand:
tarxvfcrunch3.4.tgz
NowwewillnavigatetothefolderwhereextractedtheCrunchandwilltypethefollowing
commandstoinstallit:
make&&makeinstall
Nexttypesimply"mancrunch"toreadthemanualfile.
b:maximumbytestowritetooutputfile.dependingonthe
blocksizefilesmaybesomebytessmallerthanspecifiedbutnever
bigger.
c:numbersoflinestowritetooutputfile,onlyworksif"o
START"isused,eg:60Theoutputfileswillbeintheformatof
startingletterendingletterforexample:crunch15f
/pentest/password/charset.lstmixalphaoSTARTc52willresultin
2files:a7.txtand8\.txtThereasonfortheslashinthesecond
filenameistheendingcharacterisspaceandlshastoescapeitto
printit.Yesyouwillneedtoputinthe\whenspecifyingthe

filename.
d:specifyd[n][@,%^]tosuppressgenerationofstringswithmore
than[n]adjacentduplicatesfromthegivencharacterset.For
example:./crunch55d2@Willprintallcombinationswith2or
lessadjacentlowercaseduplicates.
e:tellscrunchtostopgeneratingwordsatstring.Usefulwhen
pipingcrunchtoanotherprogram.
f:pathtoafilecontainingalistofcharactersets,eg:
charset.lstnameofthecharactersetintheabovefileeg:
mixalphanumericallspace
i:invertstheoutputsothefirstcharacterwillchangeveryoften
l:literalcharacterstouseint@,%^
o:allowsyoutospecifythefiletowritetheoutputto,eg:
wordlist.txt
p:printspermutationswithoutrepeatingcharacters.Thisoption
CANNOTbeusedwiths.Italsoignoresminandmaxlengths.
q:Likethepoptionexceptitreadsthestringsfromthe
specifiedfile.ItCANNOTbeusedwiths.Italsoignoresminand
max.
r:resumeaprevioussession.Youmustusethesamecommandlineas
theprevioussession.
s:allowsyoutospecifythestartingstring,eg:03god22fs
t[FIXED]@,%^:allowsyoutospecifyapattern,eg:@@god@@@@where
theonlythe@'swillchangewithlowercaseletters
the,'swillchangewithuppercaseletters
the%'swillchangewithnumbers
the^'swillchangewithsymbols
u:onlyprintwordssupressfilesizeinformation,akaunheardNOT
NEEDEDANYMORE
z:addssupporttocompressthegeneratedoutput.Mustbeusedwith
ooption.Onlysupportsgzip,bzip,lzma,and7z
(Note:CrunchcanbeusedonlyonLinuxOS,supportforSolaris,HPUX,Windows,BSD
isunknown.)

CreatingWordlistBasicUsage
Basicusagetocreatewordlistisasfollows:
./crunch[minlength][maxlength][characterset][options]
Tocreateaworldlistwithmin/maxlength"3"withoutcharacterset,crunchwillautomaticallyset
loweralphaascharset.

./crunch33
Crunchwillnowgeneratethefollowingamountofdata:70304bytes
0MB
0GB
0TB
0PB
Crunchwillnowgeneratethefollowingnumberoflines:17576
aaa
aab
aac
aad
aae
aaf
aag:
Tocreateaworldlistwithmin/maxlength"3"usingcharacterset"012345ABCDEF",crunchwill
generatethefollowing:
./crunch33012345ABCDEF
Crunchwillnowgeneratethefollowingamountofdata:6912bytes
0MB
0GB
0TB
0PB
Crunchwillnowgeneratethefollowingnumberoflines:1728
000
001
002
003
004
005
00A
:
Ifwouldliketoaddsomespecialcharacterslike@,!,$,%,willneedescapingwithabackslash\
./crunch33ABC\!\@\%
Crunchwillnowgeneratethefollowingamountofdata:864bytes
0MB
0GB
0TB
0PB

Crunchwillnowgeneratethefollowingnumberoflines:216
AAA
AAB
AAC
AA!
AA@
AA%
ABA
:
Crunchalsocomeswithfixedcharactersetsincharset.lstwhichisincludedintheinstallation.
So,wecanuseacharsetlist(likeJTRtutorial)tocreateawordlistlikethefollowingexample:
./crunch44fcharset.lstlalphanumeric
Crunchwillnowgeneratethefollowingamountofdata:8398080bytes
8MB
0GB
0TB
0PB
Crunchwillnowgeneratethefollowingnumberoflines:1679616
aaaa
aaab
...
sje0
sje1
...
2rii
2rij
2rik
:
(Note:Wecanusetheioptiontoinvertthedirectioninwhichthewordlistiscreated,
fromlefttorighttorighttoleft)
Alsousingtheparametero[destination_path]crunchwillcreateanoutputfiletothespecific
pathdestination.
./crunch44fcharset.lstlalphanumerico/Desktop/wordlist.txt
Tocompresstheoutputwordlistusezparameter:
./crunch44fcharset.lstlalphanumerico/Desktop/wordlist.txt
zgzip

CreatingWordlistAdvancedUsage
Crunchalsosupportsalotofadvancedoptionforcreatingcomplexwordlistsandacoupleof
parameterswhichhelpusforcompressinganexistingwordlist.
Atthispartoftutorialwilldescribetheparametert.Addingthisparameterallowstospecifya
patternoraprefixatthewordlist.Notethatusingspecialcharacterwithoutescapingitcrunch
willautomaticallygeneratedifferentwordlistforeachone.Forexample:
./crunch55twl@@@
willcreateawordlistwhichwillhasasprefixtheword"wl"andthreelowercasealphavalues.
./crunch55twl'''
wordlist'llcontaintheprefix"wl"andthreeuppercasealphavalue.
./crunch55t%%%wl
wordlist'llcontainthreenumericvaluesandthesuffix"wl".
./crunch55t^wl^^
wordlist'llcontainaspecialcharacters,theword"wl"andthentwospecialcharacters.(including
'space'character)
(Note:Wecancreateawordlistincludingmorethanoneoftheaboveoptions.)
./crunch1010twl,,^^@@%%
Ifwouldliketocreateawordlistwithaprefixwhichprefixwillcontainaspecialcharacter,we
mustusetheparameterlandspecifythespecialcharacterandthelocationofitinthewordlist.
Forexample:
./crunch66t'@dm'@@@l@aaaaa
Crunchwillnowgeneratethefollowingamountofdata:123032bytes
0MB
0GB
0TB
0PB
Crunchwillnowgeneratethefollowingnumberoflines:17576
@dmaaa

@dmaab
@dmaac
@dmaad
@dmaae
@dmaaf
:
Notethatnowaspecialcharacter'@'threatedandusedasliteral.Agoodtipistoaddourprefix
wordintabs,toseparateitfromthespecialcharacters.

EditCharset.txtList
OnthispartofTutorialwilleditandcreateoursetofcharsoncharset.txtfile:
#charsetconfigurationfileforwinrtgenv1.2byMassimilianoMontoro
(mao@oxid.it)
#compatiblewithrainbowcrack1.1andlaterbyZhuShuanglei
<shuanglei@hotmail.com>

hexlower=[0123456789abcdef]
hexupper=[0123456789ABCDEF]
numeric=[0123456789]
numericspace=[0123456789]
symbols14=[!@#$%^&*()_+=]
symbols14space=[!@#$%^&*()_+=]
symbolsall=[!@#$%^&*()_+=~`[]{}|\:"'<>,.?/]
symbolsallspace=[!@#$%^&*()_+=~`[]{}|\:"'<>,.?/]
ualpha=[ABCDEFGHIJKLMNOPQRSTUVWXYZ]
ualphaspace=[ABCDEFGHIJKLMNOPQRSTUVWXYZ]
ualphanumeric=[ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
ualphanumericspace=[ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
ualphanumericsymbol14=
[ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+=]
ualphanumericsymbol14space=
[ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+=]
ualphanumericall=
[ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+=~`[]{}|\:"'<>,.?/]
ualphanumericallspace=
[ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+=~`[]{}|\:"'<>,.?/]

wecanaddoursetofcharacterlikethefollowingexample:
set_char_name=[my,chars,,symbols]
andcanuseitaddingthenameofoursetlikeasanalreadycharset.
./crunch66fcharset.lstmy_charsett'p@@@@la@aaaao
/Desktop/wordlist.txt
Crunchwillnowgeneratethefollowingamountofdata:229376bytes
0MB
0GB
0TB
0PB
Crunchwillnowgeneratethefollowingnumberoflines:32768
p@$AAA
p@$AAB
p@$AAC
p@$AAD
p@$AAa
p@$AAb
p@$AAc
p@$AAd
:

Conclusion
Thearealotofwaysandthingscandotocreateawordlist.Thistutorialdescribesthebasic
thingswecandotocreate/generateandasimplewordlist.txtfilewhichincludenumeric,alpha,
multispecialcharactersandaprefixorasuffixword.Thebestwayistotryeveryparameteron
avirtualenvironment,creatingourwordlistfiletofigureoutwhateveryoptiondoesbefore
proceedforcreatingabasicone.
DesignedandCreatedbyLiatsisFotisforliatsisfotis.com