Each rule starts with the begin keyword and ends with the end keyword. All the statements are strictrly lowercase. Only one statement per line is acceptable and parsed.
Statements can be divided in to several categories:
Preprocessor directives
Prerequisite directives
Add statements
Enhancer statements
Delete statements
Remove statements
Insert statements
Replace statements
Additionally, there are several modifiers regarding stack usage and mode of operation.
In essence, each rule generates candidates based on the cumulative result of the statements. This means that the order of statements is important.
Each statement starts with either the must or the may keyword.
Example:
begin
must add str hello
may add str world
end
This rule will generate the candidates "hello" and "helloworld"
Currently there are a few preprocessor directives:
Currently there are three prerequisite directives:
Example:
table a @4
table e 3
Those add certain strings or patterns.
Example:
must add str mypassword
Example:
begin
must add str hello
must add numrange 1000:2000
end
This will generate all the candidates from "hello1000" up to "hello2000"
Specifier can be either:
must add set 2:4:lalpha:$%
This will generate all candidates (len 2..4) containing lower alpha and $%. Example would be "a$", "bhf" and "b$%z"
In the example above, abac is a valid candidate for "set", but not for "cset".
This generates all markov candidates length <min> to <max> using statfile <statfile> and threshold <threshold> (0 being the default one)
Example:
begin
must add pipe ls
end
This will generate candidates based on the filenames in the current directory (stupid). This command allows hashkill to use external wordlist generators/expanders.
Example:
begin
must add str hello
may add revstr
end
This rule will generate candidates "hello" and "helloolleh"
Example:
begin
must add str hello
may add lastchar
end
This rule will generate candidates "hello" and "helloo"
Example:
begin
must add str hello
may add samestr
end
This rule will generate candidates "hello" and "hellohello"
Those apply certain filters to the current candidates
Example:
begin
must add str hello
must leetify
end
This will generate "h3llo", "h3ll0", "hell0", "he11o", "he1l0", etc
Example:
begin
must add str hello
must togglecase
end
This will generate "hellO", "hEllo", "HEllo", "HELlI", "HeLlO", etc
Example:
begin
must add str welcome
may pasttense
end
This will generate "welcome" and "welcomed"
WARNING: irregular verbs are not handled as well as some specific cases.
Example:
begin
must add str welcome
may conttense
end
This will generate "welcome" and "welcoming"
WARNING: some specific cases are not handled correctly
Example:
begin
must add str abc
must insertp str !
end
This rule will generate candidates "!abc", "a!bc", "ab!c" and "abc!"
Example:
begin
must add str abc
must insertp numrange 1:5
end
This rule will generate candidates such as "3abc", "a1bc", "ab2c" and "abc5"
Example:
begin
must add str abc
must permute
end
This rule will generate candidates such as "abc", "acb", "bac" and "bca"
Example:
begin
must add str abc
must deletep
end
This rule will generate candidates "ac", "ab" and "bc"
Those delete certain parts the current candidates
Example:
begin
must add str hello
must delete 2 -1
end
This rule will generate "hel"
Example:
begin
must add str hello
must delete repeating
end
This rule will generate "helo"
Those eliminate certain candidates based on statement
Example:
begin
must add dict english
must remove ee
end
This rule will try all the candidates from "english" dictionary except those that contain "ee" (such as "feel" or "speed")
Those insert certain string at certain position
Example:
begin
must add str hello
must insert 123 1
end
This rule will generate "h123ello"
Those replace certain patterns in candidates based on statement
Example:
table a @4
begin
must add base
must replace table
end
This rule will generate "base", "b@se" and "b4se"
Example:
begin
must add base
may replace str as AS
end
This rule will generate "base" and "bASe"
Add statements may be forced to push new strings into stack instead (later on they can be pop'd). To do this, use the push keyword.
Example:
begin
push must add str hello
push may add str 123
pop
must add .
pop
end
This will generate the following candidates: "hello.hello", "hello123.hello"
The pop command may be used multiple times even when the stack is "emptied" - it returns the same string.
Two types of comments are available.
Each line starting with # is a "silent" comment and each line starting with $ is a "noisy" comment.
Difference is that hashkill will print to stderr the "noisy" comments but will supress the "silent" ones.
Advanced additive rule example
The following rule will generate all the dates starting from 1/1/1980 to 31/12/2010 (according to the dd/mm/yyyy convention):
begin
must add numrange 1:31
must add str /
must add numrange 1:12
must add str /
must add numrange 1980:2010
end
Table attack example
The built-in leetify enhance statement may not be adequate for leetify attack. A better leetify rule may be written. This leetifies all the entries from a dictionary using advanced custom table rules. Additionally, it togglecases (so that we become independant on upper/lowercase) and applies certain multi-char leetify rules (like d=|), etc)
table a @4.
table b 86
table c (
table e 3
table g 6
table i 1|!
table l 1|!
table o 0@
table s $5
table r 2
begin
must add dict dictionary.txt
may togglecase
must replace table
may replace str d |)
may replace str n |\|
end
Permutation attack example
Permutation attack is simple - we just need to use the permute statement. The following rule permutes all words from a dictionary concatenated with all numbers from numrange 1:99 applied
begin
must add dict dictionary.txt
must add numrange 1:99
must permute
end
Combinator attack example
Hashkill's rule engine (hashgen) gives a lot of freedom to combine different dictionaries. In the following example, we combine 2 dictionaries in the following pattern:
<word1>_<word2>_<word1>
Where <word1> is any word from the first dictionary, <word2> is any word from the second one, <word1> is the same <word1> from the first dictionary:
begin
must push add dict dictionary1.txt
must pop
must add str _
must add dict dictionary2.txt
must add str _
must pop
end
Advanced fingerprint attack example
Fingerprint attacks are made possible via using add/insert passwords or genmarkov and add markov keywords
An example for that is the following iterative attack: first we apply a rule to generate candidates from big_dictionary.txt wordlist.
Then we do 3 iterations, generating markov statfiles from the cracked files and trying candidates based on them:
begin
must add dict big_dictionary.txt
end
genmarkov
$Iteration 1:
begin
must add markov 1:10:cracked:0
end
genmarkov
$teration 2
begin
must add markov 1:10:cracked:0
end
genmarkov
$teration 3
begin
must add markov 1:10:cracked:0
end
Another approach would be using the add passwords statement and a set of subsequent rule statements. Rather than generating markov models, we can directly use cracked passwords and apply filters/add. E.g:
begin
must add dict big_dictionary.txt
end
$Iteration 1:
begin
must add passwords
may togglecase
may leetify
may add cset 1:5:num
end
$Iteration 2:
begin
must add passwords
may togglecase
may leetify
may add cset 1:5:num
end
$Iteration 3:
begin
must add passwords
may togglecase
may leetify
may add cset 1:5:num
end