Windows Password Recovery - hybrid dictionary attack

Hybrid dictionary attack is a form of simple dictionary attack. However, unlike the latter, hybrid attack allows user to set his own word mutation (variation) rules and attempt to validate the modified words as source passwords. For example, user could capitalize the first letter of a password being validated, append '2' to it, replace the number 8 in it with the letter B, O with 0, etc.

Actions, performed on source words from the dictionary, are called rules. Multiple rules can be applied to each source word. The rule definition syntax is partially compatible with John the Ripper and PassworsPro software. The author of the latter has kindly provided an extended set of rules, slightly edited, which comes with the distribution kit for Windows Password Recovery.

Hybrid dictionary attack settings are grouped in 6 tabs:
 1. Dictionaries - for setting up source dictionaries.
 2. Rules - files with set of rules.
 3. Dictionary generator, where you can create files of words obtained from the hybrid attack.
 4. Online dictionaries - for downloading new dictionaries to the application.
 5. Attack syntax - complete description of all rules with examples.
 6. Rule tester, where you can test your rules.

Wordlists to be used in the attack are set on the first tab. Traditionally, the application supports wordlists in ASCII, UTF8, UNICODE, PCD, RAR and ZIP format. The position of the files on the list can be altered. For example, you may want to move smaller dictionaries up the list or the other way. During the attack, they will be used one after another, according to their position on the list.




On the 'Rules' tab, define at least one file with password mutation rules. The format of the rules file is quite trivial; it is a plain-text ASCII file with the '[Rules]' string. Anything above this string is considered comments and ignored by the program. Whatever goes below this string is considered rules. Each string can contain several rules, applicable to a source word. The exclusion is the aN rule. This rule must not be on the same line with other rules. If a string contains multiple rules per word, those rules are parsed left to right. For example, if you apply the rule '@pc$a$b$c' to the source word 'password', at the output you will get 'Asswordabc'. The maximum length of an output word may not exceed 256 characters.



The 'Dictionary generator' tab is designed for generating dictionaries obtained from an attack. Further on, those dictionaries could be used, for example, in other applications. To generate a dictionary, specify a source dictionary and a set of mutation rules for it. The size of a target file may exceed 2 GB.

You can download additional wordlists for the attack using 'Online dictionaries' tab.


If you want to create your own set of rules, you can use the last two tabs as sources of help. While the 'Syntax' tab gives mere descriptions of available rules, on the last tab you can actually test them by specifying a source word and a rule for the hybrid attack. Forward your rule sets to us; if we find them interesting/useful, we will include them in the default distribution of the program.



 

Rules description for the hybrid dictionary attack

Rules