Sunday 24 July 2011

Wordlist manipulation revisited

Work In Progress !

Word List Manipulator
A script to facilitate the commonly used options to make an existing 
wordlist more to your liking.. 
Downloads below and based on using the script in Backtrack although it should work
in most Linux environments.

Google code + WIKI ;

Edit 21-10-2012
Release of WLM v0.7 ;
Video using WLM in BackBox ;


After my posts from just over 2 years ago (wow... thought I would have learned more by now .. )
I thought it would be a good idea to have another, more detailed post on wordlist manipulations based on 'simple' one-liners or simple scripts (sometimes 1 line just doesn't cut it) which can be run over the wordlist.

For some reason I always manage to forget the best way to do the simplest of things using sed and the like, so this is as much a reference for me, as it is hopefully some help to those looking for quick answers !
My intention is that queries on wordlist manipulation posted in the comments are looked at and tested
and then, I will try to post the best solution in doing same.

There will be quite a bit duplication from the previous post on wordlist manipulation, but no harm in that,
I find myself returing to 'old' info all the time..


When you have a wordlist, it often needs fine-tuning or alteration of some kind in order to get the
most out of it, sometimes heavy-duty alteration, other times minor adjustments such as splitting the wordlist into manageable sizes or capitalizing the first letter for instance.

The below examples are based on wordlists that have already been created and need some sort of tweaking or fine tuning.
Of course you can create wordlists from scratch how you like with for instance crunch, however this post is meant solely for altering existing wordlists.

Note that the below examples all done on BackTrack5 and not tested on any other OS.
(although most commands should work on most linux based OS')


One of the main issues with wordlists is that they can get hellish big.. and you may need to split them for;
>  for easy storage on portable drives,
> some programs only accept a certain maximum wordlist size,
> distributing segments of the wordlists to have tested by others,

First thing to do is to check the size of the file and how many lines(passphrases) are in it so you can estimate
how you can best split it.
In this case using a 6 digit wordlist with lowecase alpha values only.
Check the size of the wordlist ;
For info on size in bytes ;
du -b wordlist1.txt
Simple view of size in 'human readable' format (eg. 100K, 100M, 100G);
du -h wordlist1.txt

Get the linecount of the wordlist ;
wc -l wordlist1.txt

So in the above example the size is around 112MB and there are 16777216
lines (so 16777216 passphrases).
When using split to split wordlists, it is best to use split by line count, so that you don't accidentally split the actual words as can happen when you split by size.

Lets say we want to split that file into 3 wordlists, then the above file would need to be split into files containing +-5.500.000 words each.
If you are too lazy to work the little grey cells, let 'bc' do the work for you so you can make an educated guess on how many lines you want to have per split wordlist ;

echo "16777216 / 3" | bc

split -d -l 5600000 wordlist1.txt split-list
-d == giving a numeric suffix to the created split-list prefixes
-l ==  giving the number of lines you want each file to have as a maximum
wordlist1.txt is the input wordlist
splitlist is the prefix for the newly created split files.


To actually combine seperate wordlists to one list, you can use the 'cat' command as follows ;
cat wordlist1.txt wordlist2.txt > combined-wordlist.txt

Depending on the size of your wordlists this can take a wee while..

You can also combine all .txt files in a directory to one larger file ;
cat *.txt > combinedlists.txt


Changing characters in a wordlist at a given position to either lower case or upper case is a frequent necessity.
Of course wordllists can easily be created with the required case in the required position (see my post on using the awesome crunch) however if you have an existing wordlist (which this post is all about) and need
to adjust the cases as required, this is (one of the ways) how to go about it.


First letter;
sed 's/^./\u&/' wordlist.txt

Last letter;
sed 's/.$/\u&/' wordlist.txt


Changing the first letters of all entries to upper case ; 
sed 's/^./\u&/' wordlist.txt

Changing the last letter of all entries to upper case ;
sed 's/.$/\u&/' wordlist.txt

Changing the first letter of all entries to lower case ;
sed 's/^./\l&/' wordlist.txt

Changing the last letter of all entries to lower case ;
sed 's/.$/\l&/' wordlist.txt

Changing all upper case to lower case letters;
tr '[:upper:] ' '[:lower:]' < wordlist.txt

Changing all lower case to upper case letters;
tr '[:lower:]' '[:upper:]' < wordlist.txt

Inverting the case in the words ;
tr 'a-z A-Z' 'A-Z a-z' < wordlist.txt
sed 'y/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz/' wordlist.txt


To prefix the word "test" to all lines in the wordlist ;
sed 's/^./test/' wordlist.txt
awk '{print "test" $0 }' wordlist.txt


To prefix 1 digit in sequence from 0 - 9 ;
for i in $(cat wordlist.txt) ; do seq -f %01.0f$i 0 9 ; done > numbers_wordlist.txt

To prefix 2 digits in sequence from 00 - 99 ;
for i in $(cat wordlist.txt) ; do seq -f %02.0f$i 0 99 ; done > numbers_wordlist.txt

To prefix upto 2 digits in sequence from 0 - 99 ;
for i in $(cat wordlist.txt) ; do seq -f %01.0f$i 0 99 ; done > numbers_wordlist.txt

To prefix 3 digits in sequence from 000 - 999
for i in $(cat wordlist.txt) ; do seq -f %03.0f$i 0 999 ; done > numbers_wordlist.txt

To prefix upto 3 digits in sequence from 0 - 999 ;
for i in $(cat wordlist.txt) ; do seq -f %01.0f$i 0 999 ; done > numbers_wordlist.txt


To suffix the word "test" to each line in the wordlist ;
sed 's/.$/test/' wordlist.txt
awk '{print $0 "test"}' wordlist.txt


To suffix 1 digit in sequence from 0 - 9
for i in $(cat wordlist.txt) ; do seq -f $i%01.0f 0 9 ; done > wordlist_numbers.txt

To suffix 2 digits in sequence from 00 - 99
for i in $(cat wordlist.txt) ; do seq -f $i%02.0f 0 99 ; done > wordlist_numbers.txt

To suffix upto 2 digits in sequence from 0 - 99 ;
for i in $(cat wordlist.txt) ; do seq -f $i%01.0f  0 99 ; done > wordlist_numbers.txt

To suffix 3 digits in sequence from 000 - 999 ;
for i in $(cat wordlist.txt) ; do seq -f $i%03.0f 0 999 ; done > wordlist_numbers.txt

To suffix upto 3 digits in sequence from 0 - 999 ;
for i in $(cat wordlist.txt) ; do seq -f $i%01.0f  0 999 ; done > wordlist_numbers.txt


To include the word "test" after the first 2 characters ;
sed 's/^../&test/' wordlist.txt
sed 's/^.\{2\}/&test/' wordlist.txt

To include the word "test" before the last 2 characters ;
sed 's/..$/test&/' wordlist.txt
sed 's/.\{2\}$/test&/' wordlist.txt


To replace the first character of each word with "test" ;
sed 's/^./test/' wordlist.txt

To replace the first 2 characters of each word with "test" ;
sed 's/^../test/' wordlist.txt

To replace the first 3 characters of each word with "test" ;
sed 's/^.../test/' wordlist.txt 
sed 's/^.\{3\}/test' wordlist.txt


To replace the last character of each word with "test" ;
sed 's/.$/test/' wordlist.txt

To replace the last 2 characters of each word with "test" ;
sed 's/..$/test/' wordlist.txt

To replace the last 3 characters of each word with "test" ;
sed 's/...$/test/' wordlist.txt
sed 's/.\{3\}$/test/' wordlist.txt


To subsitute the third character of each word in the wordlist ;

sed -r "s/^(.{2})(.{1})/\1test/" wordlist.txt
sed 's/^\(.\{2\}\)\(.\{1\}\)/\1test/' wordlist.txt

To subsitute the third and fourth character of each word in the wordlist with "test" ;
sed -r "s/^(.{2})(.{2})/\1test/" wordlist.txt

To subsitute the fourth character of each word in the wordlist with "test" ;
sed -r "s/^(.{3})(.{1})/\1test/" wordlist.txt

To subsitute the fourth and fifth character of each word in the wordlist with "test" ;
sed -r "s/^(.{3})(.{2})/\1test/" wordlist.txt

If the number of characters that are to be replaced are actually more than there
are characters in the word, the word will remain unaltered.
So if doing 
sed -r "s/^(.{3})(.{2})/\1test/" wordlist.txt
4 character letters such as the word 'beta' would not be altered as there is no fifth character. 


rev wordlist.txt


To remove words from wordlist.txt that do not have 3 numeric values

nawk 'gsub("[0-9]","&",$0)==3' wordlist.txt


Under construction ;)


sed '/\([^A-Za-z0-9_]\|[A-Za-z0-9]\)\1\{2,\}/d' wordlist.txt

sed "/\(.\)\1\1/d" wordlist.txt

To delete words with more than 3 identical adjacent characters ;

sed "/\(.\)\1\1\1/d" wordlist.txt

Some great bit of work from Gitsnik on manipulating wordlists to ignore words with


See Wordlist Manipulator script at top of page

To give all possible variations of a word / wordlist, fantastic bit of perl by Gitsnik ;
Copy / Paste the below and save as
chmod 755 to make executable.

to test on a single word (for instance "firewall") do ;
cat firewall | ./
To test on a wordlist do ;
./ wordlist.txt


use strict;
use warnings;

my %permution = (
"a" => [ "a", "4", "@", "&", "A" ],
"b" => "bB",
"c" => "cC",
"d" => "dD",
"e" => "3Ee",
"f" => "fF",
"g" => "gG9",
"h" => "hH",
"i" => "iI!|1",
"j" => "jJ",
"k" => "kK",
"l" => "lL!71|",
"m" => "mM",
"n" => "nN",
"o" => "oO0",
"p" => "pP",
"q" => "qQ",
"r" => "rR",
"s" => "sS5$",
"t" => "tT71+",
"u" => "uU",
"v" => "vV",
"w" => ["w", "W", "\/\/"],
"x" => "xX",
"y" => "yY",
"z" => "zZ2",

# End config

while(my $word = <>) {
chomp $word;
my @string = split //, lc($word);
&permute(0, @string);

sub permute {
my $num = shift;
my @str = @_;
my $len = @str;

if($num >= $len) {
foreach my $char (@str) {
print $char;
print "n";

my $per = $permution{$str[$num]};

if($per) {
my @letters = ();
if(ref($per) eq 'ARRAY') {
@letters = @$per;
} else {
@letters = split //, $per;
$per = "";

foreach $per (@letters) {
my $s = "";
for(my $i = 0; $i < $len; $i++) {
if($i eq 0) {
if($i eq $num) {
$s = $per;
} else {
$s = $str[0];
} else {
if($i eq $num) {
$s .= $per;
} else {
$s .= $str[$i];
my @st = split //, $s;
&permute(($num + 1), @st);
} else {
&permute(($num + 1), @str);

Please leave your comments, suggestions, mocking words of wisdom..etc.. so that the post can benefit from
the vast amount of knowledge out there.

Sunday 22 May 2011

Creating wordlists with crunch v3.0


Warning... this is a looong post, grab a beverage.. ;) Also heavy on images..


Since the post on Creating wordlists with crunch v2.4 made in April last year, crunch has gone through
quite a few changes and improvements and bofh28 has now released v3.0 ! (on 16-05-2011)
To make sure that the information on this blog is staying upto date, its time for a new and improved post.
There will be a lot of duplication from my previous post on crunch, but it should then at least
be a more or less full and complete post.

I have tried to follow the alphabetical order of the options and have done a chapter per option/switch.

Please leave comments should the post be lacking information on anything you feel should be included.


crunch is a tool for creating bruteforce wordlists which can be used to audit password strength.
The size of these wordlists is not to be underestimated, however crunch can make use of patterns to reduce wordlist sizes, can compress output files in various formats and (since v2.6) now includes a message advising the size of the wordlist that will be created, giving you a 3 second window to stop the creation should the size be too large for your intended use.

The full range of options is as follows ;
-b  Maximum bytes to write per file, so using this option the wordlist to be created can be split into various
      sizes such as KB / MB / GB (must be used in combination with "-o START" switch)
-c  Number of lines to write to output file, must be used together with "-o START"
-d  Limits the number of consecutive identical characters (crunch v3.2)
-e Specifies when crunch should stop early (crunch v3.1)
-f  Path to the charset.lst file to use, standard location is '/pentest/passwords/crunch/charset.lst
    to be used in conjunction with the name of the desired charset list, such as 'mixalpha-numeric-space'
-i  Inverts the output sequence from left-to-right  to  right-to-left
    (So instead of aaa, aab, aac, aad etc, output would be aaa baa caa daa)
-l  When specifying custom patterns with the -t option, the -l switch allows you to identify which of the characters
    should be taken as a literal character instead of a place holder ( @,%^ )
-o  Allows you to specify the file name / location for the output, e.g. /media/flashdrive/wordlist.txt
-p  Prints permutations of the words or characters provided in the command line.
-q  Prints permutation of the words or characters found in a specified file
-r  Resumes from a previous session, exact same syntax to be used followed by -r
-s  Allows you to specify the starting string for your wordlist.
-t  Allows you to specify a specific pattern to use. Probably one of the most important functions !
     Place holders for fixed character sets are ;
     @   --  lower case alpha characters
        --   upper case alhpa characters
     %   --  numeric characters
    ^    --  special characters (including space)
-u  Supresses the output of wordlist size & linecount prior starting wordlist generation.
-z  Adds support to compress the generation output, supports gzip, bzip & lzma

All the below is done on backtrack 5, only tested on the 32bit versions.
crunch is not installed by default on BT5 and as yet (22-05-2011) not yet in the repo's.
(When it does hit the repo's I will amend this post to reflect installing from repo's)

so download from the source at ;
Edit; 29-01-2012
and install as follows;
tar -xvf crunch-3.2.tgz
cd crunch3.2/
make && make install

Edit 12-06-2011
crunch is now available in the BT repositories,
so can download and install on backtrack5 simply by doing a ;
apt-get update
apt-get install crunch


The default installation directory / path for crunch in backtrack 5 is

All the below examples are based on being in the crunch directory /pentest/passwords/crunch/
To run crunch from outside of crunch's own directory use ;
/pentest/passwords/crunch/crunch [min length] [max length] [ character set] [options]
example from root directory;
/pentest/passwords/crunch/crunch 8 8 abc + + \!\@\# -t  TEST^%,@ -o test.txt

Basic usage is as follows to print to screen
./crunch [min length] [max length] [character set] [options]

To write to file use the -o switch ;
./crunch [min length] [max length] [character set] [options] -o filename.txt

If no character set is defined, then crunch will default to using the lower case alpha character set;
./crunch 4 4

Also any desired character set can be enterered manually in the command line ;
./crunch 6 6 0123456789ABCDEF

Certain characters will need escaping with a backslash \  ;
./crunch 6 6 ABC\!\@\#\$


Using the -b switch, we can tell crunch to create a wordlist which is split into multiple files
of user-specified sizes.
This must be done in conjunction with -o START.

The size definition can be;  kb, mb, gb  or  kib, mib, gib
kb, mb, and gb are based on the power of 10 (i.e. 1KB = 1000 bytes)
kib, mib, and gib are based on the power of 2 (i.e. 1KB = 1024 bytes).

The output files will be named after the first and last entry in the wordlists.

To create a wordlist split into files of not more than 1mb;
./crunch 6 6 0123456789 -b 1mb -o START

To create a wordlist split in files of no more than 100mb;
./crunch 8 8 abcDEF123 -b 100mb -o START

To create a  wordlist split into files of no more that 10kb;
./crunch 4 4 0123456789 -b  10kb -o START

To create a wordlist split into files of no more than 2gb;
./crunch 8 8 0123456789ABCDEF -b 2gb -o START

(ie. number of passphrases per file)

Using the -c switch you can have crunch create wordlists which do not contain more than the
specified number of lines.
This must be used in conjunction with -o START.

To create files containing no more than 200000 (200 thousand) lines (passphrases);
./crunch 6 6 0123456789 -c 200000 -o START

To create files containing no more that 150000 (150 thousand) lines (passphrases);
./crunch 6 6 abcDEF123 -c 150000 -o START

The output files will be named after the first and last entry in the wordlists.


Crunch v3.1 is now also released (20-07-2011) and with it comes the new -e switch.

This option allows you to specify when you want the wordlist generation to stop.

So the below example will start creating the 6 character numeric wordlist, but will stop at 333333 ;
./crunch 6 6 -t %%%%%% -e 333333


Crunch also comes with fixed character sets in charset.lst which is included in the installation.
(also found in directory /pentest/passwords/crunch/ )

This saves on the typing (and typoes) when dealing with standard character sets.

To use the fixed characters sets, instead of typing in character sets manually in the command line,
you can use the -f switch to specify which character set we want to use ;

To use only upper case alpha characters;
./crunch 6 6 -f charset.lst ualpha

To use only numeric characters ;
./crunch 6 6 -f charset.lst numeric

To use hexidecimal characters (with uppercase alpha values) ;
./crunch 8 8 -f charset.lst hex-upper

To use lower case, uppercase, numeric & special characters (beware of the size ! Don't try to ;
./crunch 8 8 -f charset.lst mixalpha-numeric-all-space


Since v2.7 additional Swedish character support has also been added for our Swedish brethren, nicely contributed by Niclas Kroon.

It should be noted that you can easily create your own custom charset by simply including a line in the same format.
If you for instance know that your target has a certain medical condition known as 133tsp34k, and you have an idea of which letters/numbers are usually used (forum posts etc. etc.) , you could simply include an extra line such as ;
1337 = [4bcd3f9hijk1mn0pqr$7uvwxyz]
Doubt the above is authentic enough, but I'm sure you get the idea.
Then just run in crunch as you would any other charset;
./crunch 4 4 -f charset.lst 1337

See /pentest/passwords/crunch/charset.lst for all possibilities  / charsets currently included.

Using the -i option will invert the direction in which the wordlist is created, from left-to-right  to  right-to-left.
Note that this does not change the content of the created wordlist, it only changes the intial direction in which it is created.

./crunch 4 4 -i

The -i option can also be used when character sets have been specified, either manually or using the pre-defined charsets.
./crunch 4 4 -f charset.lst ualpha -i

or for instance for creating numeric wordlists in an alternative direction ;
./crunch 8 8 0123456789 -i

If you actually want the wordlist creation to start from the last letter in the alphabet and work backwards, or
work backwards from the last digit in a 10 digit numeric sequence, then you would have to enter the charset manually ;
./crunch 4 4 zyxwvutsrqponmlkjihgfedcba


./crunch 8 8 9876543210


Crunch can also  be used to create permutations for either ;
> characters / words entered in the command line with the -p switch.
> lines in a wordlist with the -q switch

Although there is no min/max character setting, this still needs to be entered for both
the -p and -q switch.

Using the -p switch you can create permutations of characters or of all words entered in the command line.
Creating permutations of letters (fun for anograms) ;
./crunch 1 1 -p abcd

Creating permutations of lists of words;
./crunch 1 1 -p bird cat dog

As the -p switch can read the input on command line as being letters or words, it MUST be the last option used;
If for instance trying to suppress the size output message using the -u switch and placing the -u switch last,
crunch will see 2 words (abcd + -u) and so will only print out the 2 permutation possibilities as well as actually recognizing the -u switch ;
./crunch 1 1 -p abcd -u

So to ensure the output is as expected, the -p switch MUST always be the last option, and the correct syntax
with the above example would be ;
./crunch 1 1 -u -p abcd

Using the -q switch, you can create all possible permutations of words in a text file ;
(as always, beware of the possible size ! This best done on a 'focussed' wordlist)

As an example, create a small text file with 3 lines and then run crunch over it with the -q option;
echo "bird" > test.txt && echo "cat" >> test.txt && echo "dog" >> test.txt
./crunch 1 1 -q test.txt


crunch allows a wordlist creation to be stopped and restarted, to do this we use the -r (resume) switch.
For this to work we must type the exact same line followed with the -r switch ;
./crunch 8 8 0123456789 -o test.txt
Stop the creation with a Ctrl C, then restart with ;
./crunch 8 8 0123456789 -o test.txt -r

If the wordlist was started from a specific position (see below chapter) then
when resuming the -s switch as well as input must be removed ;

When using this method, the notification on %% complete will not be accurate.
Also, when resuming, crunch will advise that it is generating xx amount of data and xx number of lines.
This information will not be correct as the calculation process thinks it is resuming from a creation of an entire wordlist, whereas it is of course resuming from a wordlist with a certain startblock.
The below picture probably explains it better..

./crunch 8 8 0123456789 -s 59999999 -o test.txt
After cancelling with a Ctrl C, resume would then be done with ;
./crunch 8 8 0123456789 -o test.txt -r


If we want to start crunch from a specific position in the wordlist we want to create, we can use the -s
switch to use a specific startblock as starting position for the wordlist.

For instance, if you started creating a wordlist, but had to cancel and resume on a different disk or HDD space ran out.
The temporary file that crunch uses for the wordlist creation is "START" located in the crunch directory

You can check this temporary file for the last couple of entries to allow you to move/rename the temp file START
and restart the wordlist creation without losing the work already done.

example ;
./crunch 7 7 0123456789 -o test.txt
> Ctrl + C stopping the wordlist creation,
> check the last couple of entries in the START temporary file ;
tail -n 2 START
> copy or rename the temporary file to a name of your liking;
cp START file1.txt
> restart the wordlist creation from the last noted entry in the temporary file;
./crunch 7 7 0123456789 -s 9670549 -o test.txt

NOTE! crunch will overwrite START when it starts a new wordlist creation process, so be sure to rename START into whatever you want to ensure you don't lose the work already done !

Of course using the starting block can be used for whatever reason, for instance if you are sure that you don't need any list with numbers starting before 59999999 ;
./crunch 8 8 0123456789 -s 59999999 -o test.txt


This is where crunch really shines, and in my humble opinion, the most powerful capability that crunch has to offer.

With a minimum amount of information on known or expected patterns and/or possible characters in the passphrase, custom patterns can be created allowing to specify what to place where in the created passhprases.
In doing so the size of the wordlist can be reduced significantly and the wordlist can be tailored to the target in a much more efficient way, which is always to be endeavoured !

To fix a pattern, we use the -t switch in crunch.

There are fixed symbols used for certain character sets ;
@ --> Lower case alpha values (or @ will read and print from a specified character set, see further down in post)
,  --> Upper case alpha values
% --> Numeric values
^ --> Special characters including 'space'

So if we want to create a 6 character, lower alpha wordlist and with a pre-fix of 'dog';
./crunch 6 6 -t dog@@@

 or if we want 'dog' to be appended ;
./crunch 6 6 -t @@@dog

or have 'dog' bang in the middle ;
./crunch 7 7 -t @@dog@@

Or 'dog' followed by an upper case alpha, number and symbol;
./crunch 6 6 -t dog,%^

Miscellaneous patterns
We can also combine the various fixed character sets, for instance, if we want to create an 8 character
wordlist with alpha, numeric and special characters in fixed positions;
./crunch 8 8 -t ,,^^@@%%

Using the fixed character sets you can quickly and easily make 'quick' wordlists for a single character set..

Creating a wordlist with only lower case;
./crunch 4 4 -t @@@@

only numeric;
./crunch 4 4 -t %%%%

or only uppercase;
./crunch 4 4 -t ,,,,

only special characters;
./crunch 4 4 -t ^^^^

And of course if certain positions and characters are known, it can all be mixed up ;
 ./crunch 9 9 -t %%DOG^^@@

We can also even go a step further and specify which range of characters should be used for each character type.
In the below example ;
lower alpha values to only be ;  abcdef
upper alpha values to only be ;  ABCDEF
numeric values to only be      ;  12345
special characters to only be  ;  @#$%

We can then specify same by entering these values manually in the command line ;
Note that it is required to enter the custom values in the order ;
lower alpha -- upper alpha -- numeric -- special characters

./crunch 8 8 abcdef ABCDEF 12345 @#$%- -t @@,,%%^^

If there is no specific character range to be used for the character set, then that position should be
completed with a '+' placeholder sign which signifies the usage of the complete standard character set for that set positon. (lower alpha -- upper alpha -- numeric -- special characters)

The below example is using 'abcdef' as lower alpha charset, the full upper case charset, '12345'as numeric charset and the full special character charset.
./crunch 8 8 abcdef + 12345 + -t @@,,%%^^

Although in the above examples @ is used as fixed character set for lower case values, we can also use it to specify a manually chosen single set of all types of characters ;
./crunch 8 8 123abcDEF -t TEST@@@@

./crunch 10 10 123abc+-= -t @@@test@@@

Remember that certain characters on some occasion require escaping, if in doubt, better to just do it.
./crunch 10 10 123abcDEF\!\@\# -t TESTING@@@

If you want to include a space in the charset, then enclose the charset in quotes ;
(space at end of charset below)
./crunch "123abcDEF " -t TEST@@@@

Creating telephone lists
You can also use the -t switch to easily make lists of telephone numbers, so if for instance the telephone number
is usually noted as for instance;  0131-321654, then you could easily create a wordlist of telephone numbers following that same example ;
./crunch  11 11 -t 0131-%%%%%%

Or if the layout is different, for instance including a space such as "(01201) 111111" this is achieved by putting quotes on the -t pattern as follows (this to ensure that the space is included);
./crunch 14 14 -t "(01201) %%%%%%"

Endless variations are possible.

The possiblities crunch offers to create patterns with such detail give you many options to really fine-tune what you want placed where in your passphrase wordlist and thus reduce the size of your final wordlist.

When you start manually defining what to place where with special characters, you will on some occasions need to to 'escape' characters to allow crunch to read them correctly.

This is the case for for instance an exclamation mark ! ;
./crunch 4 4 -t 12!@
will result in an error.
In order to make it work correctly you must 'escape'  the exclamation mark ;
./crunch 4 4 -t 12\!@

As some special characters are used to define character sets, this can cause some limitations when trying to fix positions of certain special characters. Such as wanting to use @ as a fixed character ;
./crunch 4 4 -t 012@
./crunch 4 4 -t 012\@
This will not fix the character '@' but use it to provide lower case alpha values.

To remedy this to some extent, since crunch v3.0, the new -l switch can be used to fix the literal character instead of having it refer to a place holder for a specific character set.

This would now be accomplished by doing ;
./crunch 6 6 -t b@d%%% -l @

Other possibilities;
./crunch 8 8 -t P@SS%%%% -l @
./crunch 8 8 -t P@\$\$,,,, -l @
etc. etc.

./crunch 8 8 -f charset.lst mixalpha -t pass^^@@ -l ^

Also, more than 1 placeholder character can be fixed as a literal character;
./crunch 8 8 -f charset.lst mixalpha -t pass@,%^ -l %^

Of course this in itself also has limitations as you are not able to to check for all possible lower case alpha
values or passthrough a user defined charset with a fixed setting of the @ character.
The below 2 examples will obviously only return 1 result as all the instances of the @ character will be fixed
as a literal character.
./crunch 8 8 -t p@ss@@@@ -l @
./crunch 8 8 -f charset.lst mixalpha-numeric -t p@ss@@@@ -l @
This is an issue that is being looked into and possibly a following update of crunch will have an answer.

Of course there are workarounds for some part; if for instance you wanted a password list to start with "p@ss"
followed by 4 characters of all possible lower case values, you could create a list of 4 characters;
./crunch 4 4 -o test.txt

And then use 'sed' or 'awk' to place the word 'p@ss' in front of each line ;
Using sed ;
sed 's/^/p\@ss/' test.txt > file1.txt
Using awk ;
awk '{print "p@ss" $0}' test.txt > file1.txt

So with a bit of imagination and a couple of oneliners with sed or awk, you should still
be able to create more or less what you want.

edit 25-05-2011
bofh28 has informed me of another workaround which can be used.

You can override the standard characters per placeholder setting by entering a different type of
charset in a different position and then using the placeholder character for that position.

Normally the 3rd position is for numeric values, however if you specify lower case values, it will use these
characters, however you then do need to use the place holder for that position, in this example %.

Confused ? You won't be after this episode of .. ;)

./crunch 8 8 + + abcdefghijklmnopqrstuvwxyz + -t p@ss%%%% -l @


Crunch can be used to pipe passwords through to programs such as aircrack / pyrit / cowpatty etc.

Considering that crunch is now advising the estimated size of wordlists to be created following the command given as well as the wordcount, to have a seamless integration with piping, it is recommended to use the -u option to supress that information on size, wordcount etc.;
Without using the -u command, it is possible that unexpected errors occur with some programs.

Using the -u option will result in the creating of the wordlist directly instead of giving the 3 second delay during which the estimated wordlist size and wordcount is shown ;

In examples only testing for 8 character numeric passwords ;
./crunch 8 8 -t %%%%%%%% -u | aircrack-ng -e SSID -w - /pathto/capfile.cap

./crunch 8 8 -t %%%%%%%% -u | cowpatty -f - -r /pathto/capfile.cap -s SSID

./crunch 8 8 -t %%%%%%%% -u | pyrit -i - -r /pathto/capfile.cap -e ESSID attack_passthrough


Output files can be compressed with crunch using the -z switch.

Supported formats are;
> gzip
> bzip
> lzma

Crunch will first create the wordlist and will then compress the wordlist.
Upon the finalisation of the wordlist creation, you will see the 100% being reached
and the 100% denomination will continue to be printed until the compression is complete.

So if you see a continuous 'stream' of 100%, don't worry, the program is not hanging,
the output file is simply being compressed.
It had me guessing when I was testing a compression of a couple of gigabytes.. but I assure you it is the case.

The best level of compression and thus the slowest is obtained with lzma.
The quickest compression, with the lowest level of compression, is obtained with gzip.

./crunch 6 6 -f charset.lst lalpha -o test.txt -z gzip
To unzip the created file ;
gunzip test.txt.gz

./crunch 6 6 -f charset.lst lalpha -o test.txt -z bzip2
To decompress the created file ;
bunzip2 test.txt.bz2

./crunch 6 6 -f charset.lst lalpha -o test.txt -z lzma
To decompress the created file ;
unlzma test.txt.lzma

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

If you managed to come this far, well done, you are a patient / dedicated person :)
Hope it wasn't too boring to go through ;)

bofh28 has once again done a fantastic job in reaching the 3.0 milestone and
a little birdy tells me there is yet more to come :D
If and when revisions come out, I will try to keep this post updated to reflect the changes / additions.

Keep up the great work bofh28 !!

To actually manipulate an already created/existing wordlistm check out ;
Google Analytics Alternative