I have a hashcat
command line input via textarea to validate. The following commands are correct:
# wordlist attack
hashcat -a 0 -m 400 example400.hash example.dict
hashcat -a 0 -m 0 example0.hash example.dict -r rules/best64.rule
hashcat -a 0 -m 0 example0.hash example.dict -r rules/rule1.rule -r rule2.rule
# bruteforce attack
hashcat -a 3 -m 0 example0.hash ?a?a?a?a?a?a
hashcat -a 3 -m 0 example0.hash -1 ?l?d?s?u ?1?1?1?1?1?1?1?1?1
where:
-a
follows by 0 or 3 (attack type)-m
follows by an integer (hash mode)-r
follows by a file path (rule list)-1
is custom character set, followed by a pattern
The basic syntax is:
# Word List Attack
hashcat -a 0 -m {int} {HASH_FILENAME} {DICTIONARY_FILENAME}
# Word List Attack with 1 Rule
hashcat -a 0 -m {int} {HASH_FILENAME} {DICTIONARY_FILENAME} -r {RULE_FILENAME}
# Word List Attack with multiple rules (can append infinite number of rules)
hashcat -a 0 -m {int} {HASH_FILENAME} {DICTIONARY_FILENAME} -r {RULE1_FILENAME} -r {RULE2_FILENAME}
The other syntaxes can be found at the official documentation.
I tried to use the following jQuery code to validate during form submission, but I failed to catch some cases:
$('#frm_task').submit(function(event) {
event.preventDefault();
var cmd = $('#cmdLine').val(); // where the #cmdLine is the textarea
cmd = cmd.replace('hashcat', '').trim();
return checkCmd(cmd);
});
function checkCmd(cmd) {
var args = cmd.split(' ');
// Check for Attack Mode Flag
var attackFlagPos = $.inArray('-a', args);
if(attackFlagPos !== -1) {
if(args[attackFlagPos + 1] != undefined && Number.isInteger(args[attackFlagPos + 1])) {
args.splice(attackFlagPos, 2); // remove the found `-a` and the numeric value after
cmd = args.join(' ');
checkCmd(cmd); // check again
} else {
console.error('Syntax Error: Missing Attack Mode value');
return false;
}
} else {
console.error('Missing Attack flag');
return false;
}
// Check for Hash Mode Flag
var modeFlagPos = $.inArray('-m', args);
if(modeFlagPos !== -1) {
if(args[modeFlagPos + 1] != undefined && Number.isInteger(args[modeFlagPos + 1]) && (args[modeFlagPos + 1] == 0 || args[modeFlagPos + 1] == 3)) {
args.splice(modeFlagPos, 2); // remove the found `-m` and the numeric value after
cmd = args.join(' ');
checkCmd(cmd); // check again
} else {
console.error('Syntax Error: Missing Hash Mode value');
return false;
}
} else {
console.error('Missing Mode flag');
return false;
}
// Check for Rule Flags (extra rules will be checked and removed in the next iteration)
var ruleFlagPos = $.inArray('-r', args);
if(ruleFlagPos !== -1) { // Rule file flag exists
if(args[ruleFlagPos + 1] != undefined && typeof args[ruleFlagPos + 1] == 'string') {
args.splice(ruleFlagPos, 2); // remove the found `-r` and the rule file after
cmd = args.join(' ');
checkCmd(cmd); // check again
} else {
console.error('Missing Rule list');
return false;
}
}
// TODO: Check Bruteforce Attack syntaxes
// Can I use Regex for this?
// TODO: Check for Hashlist and Dictionary List
// I am confused in this part, how can I differentiate the hashlist and dictionary list?
// if everything is okay, return true to submit the form
return true;
}
My question is:
- How can I simplify this piece of code?
- How can I check the bruteforce attack patterns (i.e.
-1 ?l?d?s?u ?1?1?1?1?1?1?1?1?1
)?
Sorry for such a long question. Thanks in advance.