Crunch

Word list generator.

Usage Examples

-tspecify the format
@lowercase (from specified charset, if any)
,uppercase (from specified charset, if any)
%number
^symbols (from specified charset, if any)

The order in character set MUST be lowercase, uppercase, numbers, then symbols.

Specifying characters to use

You must specify the order as lower case character, upper case character, number, and symbol. If you aren’t going to use a particular character set you use a plus sign as a placeholder.

lowercase number symbol: a1!

crunch 3 3 abc + 123 !@# -t @%^

UPPERCASE hehe (fixed string) lowercase number special: Ahehea1@

crunch 8 8 abc ABC 123 @# -t ,hehe@%^

Fixed password with numbers at the end: Password00 to Password99

crunch 10 10 0123456789 -t Password%% -o passwords.txt

Fixed password with specials & numbers at the end: happy-new+year2014

happy +-_*& new +-_*& year201 number

crunch 18 18 "\+-_*&" 2468 -t happy@new@year201,

Respects common password policy: min 8 chars, lower, upper, number, special

UPPERCASE lowercase(5) number special: Aaaaaa1@

crunch 8 8 abc ABC 123 @# -t ,@@@@@%^

Respects common password policy: min 8 chars, lower, upper, number

UPPERCASE lowercase(5) number special: Aaaaaa01

crunch 8 8 abc ABC 123 @# -t ,@@@@@%%

Phone numbers – starting with 514

DIR=/usr/share/wordlists
crunch 10 10 0123456789 -t 514%%%%%%% -o $DIR/phones514.txt

Numbers only

DIR=/usr/share/wordlists
crunch 1 5 0123456789 -o $DIR/wl_numbers_1_5.txt
crunch 6 6 0123456789 -o $DIR/wl_numbers_6.txt
crunch 7 7 0123456789 -o $DIR/wl_numbers_7.txt
crunch 8 8 0123456789 -o $DIR/wl_numbers_8.txt

Basic Authentication – username=password

# Generate 6 char : same 6 char
DIR=/usr/share/wordlists
crunch 6 6 ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 -o $DIR/wl_custom_6.txt

# Will give AAAAAA:AAAAAA (username=password)
# Then use in Burp with base64 encoding
paste -d ":" $DIR/wl_custom_6.txt $DIR/wl_custom_6.txt > $DIR/basic_auth.txt

Bruteforce – 3 to 8 characters

List is almost 2GB!

DIR=/usr/share/wordlists
crunch 3 8 -o $DIR/brute3_8chr.txt

Bruteforce – 1 to 8 alphanum lowercase characters

# Used by Bell routers.

DIR=/usr/share/wordlists
CHARSET=/usr/share/crunch/charset.lst
crunch 1 8 -f $CHARSET lalpha-numeric -o $DIR/wl_lalphanum_1_8.txt

Bruteforce – 8 characters (ALL)

53 PB! Crunch will now generate the following number of lines: 6634204312890625

crunch 8 8 -f /usr/share/crunch/charset.lst mixalpha-numeric-all-space -o wl-8chars.txt