101

• 
• 

---

MATH

• Possible Combinations = Character Set Size (power) Password Length
• 
  • With increase in length, or character set size, the complexity increases multifolds
• 
• 

---

Hybrid Attacks:

• org requires user to change password frequently

• this change could have patterns

• If we know a password policy, we can create a targeted wordlist from a huge wordlist:

  • eg: we know the policy - min length: 8 chars, has 1 upper, lower, number
• STEP 1:
  • grep -E '^.{8,}$' darkweb2017-top10000.txt > darkweb2017-minlength.txt
    • minimum length: 8 chars
• STEP 2:
  • grep -E '[A-Z]' darkweb2017-minlength.txt > darkweb2017-uppercase.txt
• STEP 3:
  • grep -E '[a-z]' darkweb2017-uppercase.txt > darkweb2017-lowercase.txt
• STEP 4:
  • grep -E '[0-9]' darkweb2017-lowercase.txt > darkweb2017-number.txt
• This is like chaining the biggest file and keep filtering until we get all the requirements as per the policy