Many times in penetration testing engagements you will discover authentication forms that you will need to bypass in order to gain access to an application or to a remote system. Having a big and a good wordlists always help but as a penetration tester you must be able to create your own custom wordlists depending on the situation. There are a variety of tools that can assist you on this but here we will focus on Crunch
Of course instead of just letters we can create a wordlist that will include only numbers with the command:
./crunch 5 5 12345 -o numbers.txt
The same method applies and if we want to create a wordlist mixed with letters and numbers.
./crunch 5 5 pentestlab123 -o numbersletters.txt
Special Characters
For special characters like !$% you will need to execute something like the following:
./crunch 5 5 pentestlab\%\@\!
This is because some special characters need escaping and the \ is used before the character.
String Permutations
Here there are two options.First options is when we will want to generate something based on the characters of a word.For example ./crunch 1 1 -p abc will produce the following list:
The second option is when we will want to create a list based on different words.For example the words blue and red can be bluered or redblue.We can achieve this with the command ./crunch 1 1 -p pen test lab
Splitting Wordlists
If we use the -b option we will instruct crunch to create a wordlist which will be divided into multiple files.Another option that we can combine with that command is to choose the size of our wordlist.For example:
./crunch 6 6 0123456789 -b 1mb -o START
This will generate wordlists which will be 1Mb each and with 6 characters size and it will include the characters 0123456789.
Specify the number of words
Crunch allows us to specify the number of words in each wordlist. This will create a wordlists that it will contain 20 words maximum by taken a specific charset of lalpha which is [abcdefghijklmnopqrstuvwxyz].
./crunch 3 3 -f charset.lst lalpha -o START -c 20
Alternatively you can use any other charset from the list that comes with crunch if you don’t want to use a custom charset.
Prefix Wordlists
Now lets say that we want to create a wordlist that will contains the word pentestlab followed by 3 random characters.The command for that will be:
./crunch 13 13 -f charset.lst lalpha -t pentestlab@@@
which will produce the following output:
Alternatively if we want the word admin to be in the middle we can modify the command like this:
./crunch 9 9 -f charset.lst -t @@admin@@
Compression
You can compress your wordlist with the -z option using either bzip,gzip or lzma. Zip
According to survey lzma is best cpmpression but decompression is slower.
Example: ./crunch 4 4 -f charset.lst lalpha -o wordlist -z gzip
Conclusion
Creating wordlists can facilitate your needs when performing a penetration test. Crunch of course offers a variety of options and combinations that a user can play with. Trying to brute force of course an application or a system with a wordlist can of course lock you out depending on the account lockout policy but it always helps if you can have your own custom wordlists that may be help you to obtain access.
Happy Pen-testing guys 😀
Cyber Security 