hashcat Forum

Hello,

I am running hashcat to crack some NTLM passwords for testing. I noticed that there is a huge difference in estimated time when running hashcat with --increment parameter vs. providing a password length mask.

Here is an example...


We then run it using the --increment parameter and set it to start/end at 9 characters.



How come the estimated time is so much different yet both are 9 character using the same "-1 ?u?l?d!@#$" (upper, lower, digits, and only !@#$ special characters).

I must not be understanding something correctly, anyone able to point me in the right direction?

Why is a password length of 9 characters defined as ?1?1?1?1?1?1?1?1?1 much longer to crack vs. the same password length defined as --increment --increment-min 9 --increment-max 9 ?

Pay attention, masks are different for the two attacks, so yes, estimated times will be different.
Actually defining the mask for the second one could be a great idea.

That makes sense now, thank you. So with the --increment it is using a mask = (?1?2?2?2?2?2?2?3). 

Just so i understand this fully, by adding "-1 ?u?l?d!@#$" I am defining the character range only for the ?1 in the mask above.

What will ?2 and ?3 in the mask above use?

I already looked at the wiki/faq, you pointing me back there is not helping.

What would be helpful if you could answer my question instead of sending me back in a loop.

When we run:


The input mode mask is:


I already set..
?1 = ?u?l?d!@#$

What is the default character set used for ?2 and ?3...

Before you point me back to other links, I did read everything related "Hashcat mask" and I am still confused, as such I came here looking for answers not links.

(11-10-2016, 09:24 PM)v3rd1ct Wrote: [ -> ]I already looked at the wiki/faq, you pointing me back there is not helping.

It's not about looking, it's about reading.

(11-10-2016, 09:24 PM)v3rd1ct Wrote: [ -> ]The input mode mask is:

Code:

Input.Mode.....: Mask (?1?2?2?2?2?2?2?3?3) [9]

I already set..
?1 = ?u?l?d!@#$

What is the default character set used for ?2 and ?3...

What would be helpful if you could answer my question instead of sending me back in a loop.


Before you point me back to other links, I did read everything related "Hashcat mask" and I am still confused, as such I came here looking for answers not links.

Still, you need to actually read, I don't post links for fun and giggles, it's because you people keep asking the same questions, so we try our best to compile all the answers in a FAQ (you know, not reinventing the wheel and shit).

I have also another pro tip about links, I myself spent quite some time on the Internet, and know some things, when you follow a link, it leads to a page, and sometimes there may be more links on that page, leading to even more answers.


tl;dr:
Go on the link I posted in my previous post (reminder: https://hashcat.net/wiki/doku.php?id=fre...s_it_doing) and read even only the first line of that paragraph, there is a link which leads to the answers (yes you can even follow it).