【安全工具】Crunch生成定制化字典

Crunch 是 Linux 下一款用于创建定制化密码字典的命令行工具，预装在 Kali Linux 里，使用 Crunch 生成的字典可以直接输出到屏幕、保存到文件，或者用于另一程序。在实际渗透中，字典的排版排序直接影响了破解的时间。

CRUNCH(1)                   General Commands Manual                  CRUNCH(1)

NAME
       crunch - generate wordlists from a character set

SYNOPSIS
       crunch <min-len> <max-len> [<charset string>] [options]

DESCRIPTION
       Crunch can create a wordlist based on criteria you specify.  The output
       from crunch can be sent to the screen, file,  or  to  another  program.
       The required parameters are:

       min-len
              The  minimum  length  string  you want crunch to start at.  This
              option is required even for parameters that won't use the value.

       max-len
              The maximum length string you  want  crunch  to  end  at.   This
              option is required even for parameters that won't use the value.

       charset string
              You  may specify character sets for crunch to use on the command
              line or if you leave it blank crunch will use the default  char‐
              acter sets.  The order MUST BE lower case characters, upper case
              characters, numbers, and then symbols.  If you don't follow this
              order  you  will not get the results you want.  You MUST specify
              either values for the character type or a plus sign.   NOTE:  If
              you  want  to  include the space character in your character set
              you must escape it using the \ character or enclose your charac‐
              ter  set in quotes i.e. "abc ".  See the examples 3, 11, 12, and
              13 for examples.

OPTIONS
       -b number[type]
              Specifies the size of the output file, only works if -o START is
              used,  i.e.:  60MB   The  output  files will be in the format of
              starting letter-ending letter for example: ./crunch 4 5 -b 20mib
              -o START will generate 4 files: aaaa-gvfed.txt, gvfee-ombqy.txt,
              ombqz-wcydt.txt, wcydu-zzzzz.txt valid values for type  are  kb,
              mb,  gb,  kib, mib, and gib.  The first three types are based on
              1000 while the last three types are based on 1024.   NOTE  There
              is  no  space between the number and type.  For example 500mb is
              correct 500 mb is NOT correct.

       -c number
              Specifies the number of lines to  write  to  output  file,  only
              works if -o START is used, i.e.: 60  The output files will be in
              the  format  of  starting  letter-ending  letter  for   example:
              ./crunch  1  1 -f /pentest/password/crunch/charset.lst mixalpha-
              numeric-all-space -o START -c 60 will result in 2 files: a-7.txt
              and  8-\  .txt  The reason for the slash in  the second filename
              is the ending character is space and ls  has  to  escape  it  to
              print it.  Yes you will need to put in the \ when specifying the
              filename because the last character is a space.

       -d numbersymbol
              Limits the number of duplicate characters.   -d  2@  limits  the
              lower  case  alphabet to output like aab and aac.  aaa would not
              be generated as that is 3 consecutive letters of a.  The  format
              is number then symbol where number is the maximum number of con‐
              secutive characters and symbol is the symbol of the the  charac‐
              ter set you want to limit i.e. @,%^   See examples 17-19.

       -e string
              Specifies when crunch should stop early

       -f /path/to/charset.lst charset-name
              Specifies a character set from the charset.lst

       -i  Inverts  the  output  so  instead  of  aaa,aab,aac,aad, etc you get
              aaa,baa,caa,daa,aba,bba, etc

       -l When you use the -t option this option tells  crunch  which  symbols
              should  be  treated as literals.  This will allow you to use the
              placeholders as letters in the pattern.  The -l option should be
              the same length as the -t option.  See example 15.

       -m Merged with -p.  Please use -p instead.

       -o wordlist.txt
              Specifies the file to write the output to, eg: wordlist.txt

       -p charset OR -p word1 word2 ...
              Tells crunch to generate words that don't have repeating charac‐
              ters.  By default  crunch  will  generate  a  wordlist  size  of
              #of_chars_in_charset  ^  max_length.   This  option will instead
              generate #of_chars_in_charset!.  The  !  stands  for  factorial.
              For example say the charset is abc and max length is 4..  Crunch
              will by default generate 3^4  =  81  words.   This  option  will
              instead  generate 3! = 3x2x1 = 6 words (abc, acb, bac, bca, cab,
              cba).  THIS MUST BE THE LAST OPTION!  This option CANNOT be used
              with -s and it ignores min and max length however you must still
              specify two numbers.

       -q filename.txt
              Tells crunch to read filename.txt  and  permute  what  is  read.
              This  is  like the -p option except it gets the input from file‐
              name.txt.

       -r Tells crunch to resume generate words from where it  left  off.   -r
              only  works if you use -o.  You must use the same command as the
              original command used to generate the words.  The only exception
              to  this is the -s option.  If your original command used the -s
              option you MUST remove it before you resume the  session.   Just
              add -r to the end of the original command.

       -s startblock
              Specifies a starting string, eg: 03god22fs

       -t @,%^
              Specifies  a pattern, eg: @@god@@@@ where the only the @'s, ,'s,
              %'s, and ^'s will change.
              @ will insert lower case characters
              , will insert upper case characters
              % will insert numbers
              ^ will insert symbols

       -u
              The -u option disables the printpercentage thread.  This  should
              be the last option.

       -z gzip, bzip2, lzma, and 7z
              Compresses  the output from the -o option.  Valid parameters are
              gzip, bzip2, lzma, and 7z.
              gzip is the fastest but the compression is minimal.  bzip2 is  a
              little slower than gzip but has better compression.  7z is slow‐
              est but has the best compression.

以下是中文简洁版说明

crunch <min-len> <max-len> [<charset string>] [options]

min/max：设定最小/最大字符串长度（必选）

charset_string：用自己指定的字符集生成字典（默认为 26 个小写英文字母）

-b：指定文件输出大小，避免字典文件过大
-c：指定文件输出行数，即包含密码的个数
-d：限制相同元素出现的个数
-e：定义停止符，即遇到该符号时停止生成字典
-f：调用库文件（/etc/share/crunch/charset.lst）
-i：改变输出格式，即 aaa，aab -> aaa，baa
-l：通常与-t联合使用，表明该字符为实义字符
-m：通常与-p搭配
-o：将密码保存到指定文件
-p：指定元素以组合方式出现
-q：读取密码文件，即读取 pass.txt
-r：重义某一字符串重新开始
-s：指定一个开始的字符，即从自己定义的密码xxx开始
-t：指定密码输出格式
-u：禁止打印百分比
-z：压缩生成的字典（支持 gzip、bzip2、lzma、7z）

规范使用示例

① 3位数长度，由 a、b 和 空格组成

crunch 3 3 "ab "

② 指定元素内部的排列方式（前两个参数是废的，因为这就是简单的全排列问题）
可用社工中收集的信息进行组合。

crunch 1 2  -p ab 2019 ..

③ 自定义格式化输出（相当于Crunch的正则表达式，只有四条很容易记）
同样的，前两个参数也是敲定的（由格式化字符串长度决定）
@ will insert lower case characters
, will insert upper case characters
% will insert numbers
^ will insert symbols

crunch 8 8 -t %%h@ck^^ -l aaa@aaaa	# 用a进行占位，没有特别的意义

附录：/usr/share/crunch/charset.lst

z@ubuntu:~/Downloads$ cat /usr/share/crunch/charset.lst 
# charset configuration file for winrtgen v1.2 by Massimiliano Montoro ([email protected])
# compatible with rainbowcrack 1.1 and later by Zhu Shuanglei 


hex-lower                     = [0123456789abcdef]
hex-upper                     = [0123456789ABCDEF]

numeric                       = [0123456789]
numeric-space                 = [0123456789 ]

symbols14                     = [!@#$%^&*()-_+=]
symbols14-space               = [!@#$%^&*()-_+= ]

symbols-all                   = [!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/]
symbols-all-space             = [!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ]

ualpha                        = [ABCDEFGHIJKLMNOPQRSTUVWXYZ]
ualpha-space                  = [ABCDEFGHIJKLMNOPQRSTUVWXYZ ]
ualpha-numeric                = [ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
ualpha-numeric-space          = [ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 ]
ualpha-numeric-symbol14       = [ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=]
ualpha-numeric-symbol14-space = [ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+= ]
ualpha-numeric-all            = [ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/]
ualpha-numeric-all-space      = [ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ]

lalpha                        = [abcdefghijklmnopqrstuvwxyz]
lalpha-space                  = [abcdefghijklmnopqrstuvwxyz ]
lalpha-numeric                = [abcdefghijklmnopqrstuvwxyz0123456789]
lalpha-numeric-space          = [abcdefghijklmnopqrstuvwxyz0123456789 ]
lalpha-numeric-symbol14       = [abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-_+=]
lalpha-numeric-symbol14-space = [abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-_+= ]
lalpha-numeric-all 	      = [abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/]
lalpha-numeric-all-space      = [abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ]

mixalpha                   = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ]
mixalpha-space             = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ ]
mixalpha-numeric           = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mixalpha-numeric-space     = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 ]
mixalpha-numeric-symbol14  = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=]
mixalpha-numeric-symbol14-space = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+= ]
mixalpha-numeric-all       = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/]
mixalpha-numeric-all-space = [abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ]

#########################################################################################
#                 SWEDISH CHAR-SUPPORT                                                  # #########################################################################################

#########################
# Uppercase             #
#########################
ualpha-sv                        = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ]
ualpha-space-sv                  = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ ]
ualpha-numeric-sv                = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789]
ualpha-numeric-space-sv          = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789 ]
ualpha-numeric-symbol14-sv       = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+=]
ualpha-numeric-symbol14-space-sv = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+= ]
ualpha-numeric-all-sv            = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/]
ualpha-numeric-all-space-sv      = [ABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ]

#########################
# Lowercase             #
#########################
lalpha-sv                        = [abcdefghijklmnopqrstuvwxyzåäö]
lalpha-space-sv                  = [abcdefghijklmnopqrstuvwxyzåäö ]
lalpha-numeric-sv                = [abcdefghijklmnopqrstuvwxyzåäö0123456789]
lalpha-numeric-space-sv          = [abcdefghijklmnopqrstuvwxyzåäö0123456789 ]
lalpha-numeric-symbol14-sv       = [abcdefghijklmnopqrstuvwxyzåäö0123456789!@#$%^&*()-_+=]
lalpha-numeric-symbol14-space-sv = [abcdefghijklmnopqrstuvwxyzåäö0123456789!@#$%^&*()-_+= ]
lalpha-numeric-all-sv            = [abcdefghijklmnopqrstuvwxyzåäö0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/]
lalpha-numeric-all-space-sv      = [abcdefghijklmnopqrstuvwxyzåäö0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ]

#########################
# Mixcase               #
#########################
mixalpha-sv                   = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ]
mixalpha-space-sv             = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ ]
mixalpha-numeric-sv           = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789]
mixalpha-numeric-space-sv     = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789 ]
mixalpha-numeric-symbol14-sv  = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+=]
mixalpha-numeric-symbol14-space-sv = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+= ]
mixalpha-numeric-all-sv       = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/]
mixalpha-numeric-all-space-sv = [abcdefghijklmnopqrstuvwxyzåäöABCDEFGHIJKLMNOPQRSTUVWXYZÅÄÖ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/ ]