Need to know what tool can be used to augment a dictionary + use attack passthrough

[crypts3c]

This is with respect to WPA2 (non-WPS).

I am pretty experienced with WPA2 cracking methods and tools, but I tend to use mostly pyrit, aircrack, and crunch in various combinations. But I'm working on something wherein I have partial knowledge of the passphrase, but also limited resources...

I'm wondering if there is a way to use crunch or hashcat (or another tool) to augment an existing dictionary (like adding a mask to a dictionary), and then pipe that to pyrit/cowpatty/aircrack in an attack passthrough.

I'm sure most of you are aware of the Netgear router (models WNDR and possibly others) for which the default WPA passphrase is relatively easy to find as it consists of an adjective + noun + /d{3}.

I have a list with adjective + noun. I would like to take each and append 000-999 to it. This is simple to do obviously in bash or python, and I have created the requisite script using python, but unfortunately, my hard drive space restrictions do not allow me to generate and store the full list.

So it seems as if I will need to pipe a live generation of each passphrase into a cracking tool to generate the pmk and then check against my handshake.

Does anyone know of a tool that will allow me to do this? Or, maybe even simpler, does anyone familiar with python know how I might pipe the output of my python script to say aircrack or pyrit? In other words, could I use my script instead of crunch to passthrough the generated passphrases to pyrit/aircrack/cowpatty? Currently my script writes to a file, so maybe it just needs to go to stdout(?).

If anyone has any thoughts, please comment... You have my appreciation in advance!

Thank you
crypts3c

[mmusket33]

The best tool is elcomsoft with windows and two high end video cards but if you must use linux the following links will take you thru the use of John the Ripper pass thru and advanced word altering routines .

https://forums.kali.org/showthread.p...crack-ng-theme

https://forums.kali.org/showthread.p...ight=john+pass


Musket Teams

[crypts3c]

Thank you sir!

I actually have Elcomsoft... Acquired by way of a torrent, but I was curious to see its potential without spending anything.

I have not even installed it (and you are correct, Windows is not where I tend to spend much time, especially for promiscuous adapter settings and injection, although I know things are improving on that front).

You seem to hold it in high regard for passphrase generation. If possible, and time permitting, could you summarize in ~50 words as to what makes it stand out? I have heard one or two others mention it, and now the ubiquitous musket teams proclaims its endorsement, so my curiosity is piqued.

[mmusket33]

To: crypts3c

Elcomsoft is the tool of choice for WPA Brute Force Operations because of the ease of use with higher end video cards which easily give speeds in the 59000 range and greater. We can check all mobile phone number in our areas in less then 30 minutes.
It also supports a crunch like passthru called a mask attack and has a long menu off alterations to a wordlist.

Make sure you install two video cards that are supported by the software and use Win 7 or higher.

MTeams usually only uses linux when brute forcing WPA to produce pmk against static ESSIDs that never alter their name.

MTeams