Crunch

Yes, Crunch is included in the default Kali Linux installation, so no extra setup is needed. If it is missing on a minimal image you can add it with `sudo apt install crunch`. Verify the version with `crunch --version`.

Crunch generates wordlists algorithmically from character sets and patterns you define, producing every possible combination. CeWL instead scrapes a website to build a wordlist from words that actually appear on it. Use Crunch for pattern-based or policy-based lists and CeWL for target-specific vocabulary during authorized testing.

Crunch ships with `/usr/share/crunch/charset.lst`, which defines named sets like `lalpha` and `mixalpha-numeric-all`. Reference one with the `-f` flag, e.g. `crunch 8 8 -f /usr/share/crunch/charset.lst mixalpha -o wordlist.txt`. You can copy that file and edit it to define your own named character sets.

Crunch has no true resume feature, but the `-s` flag lets you start generation from a specific string, e.g. `crunch 6 6 -s aab000`. By noting the last value written before an interruption, you can restart close to where you stopped instead of regenerating the whole keyspace.

Crunch works with any byte values you pass in a custom character set, so accented and other characters can be included directly on the command line, e.g. `crunch 4 4 abcñé`. Full multi-byte Unicode support can be inconsistent, so verify a small sample of the output before generating a large list.

Use `-b` to cap each file by size or `-c` to cap it by number of lines, combined with `-o START`. For example `crunch 8 8 -b 20mib -o START` writes a series of files no larger than 20 MiB each, which keeps individual files manageable for tools that struggle with huge inputs.

Crunch is a wordlist generator that creates every possible character combination within specified parameters. It generates wordlists from character sets and patterns, making it ideal for PIN lists, brute-force dictionaries, and pattern-based password testing.

Use: crunch 6 6 0123456789 -o pins.txt. This generates all combinations from 000000 to 999999 (1 million PINs). The first two numbers are min and max length, followed by the character set.

Use stdout piping: crunch 6 6 0123456789 | hashcat -m 0 hashes.txt. This streams PINs directly to Hashcat without creating intermediate files, saving disk space.

@ generates lowercase letters, , generates uppercase letters, % generates numbers, and ^ generates symbols. For example, -t pass@@@@ generates 'pass' + 4 lowercase letters (passaaaa through passzzzz).

Use -b for maximum bytes per file and -z to compress output. For very large character sets, use patterns to reduce output to only the combinations you need, or pipe directly to tools without saving files.

Yes, use patterns like -t @@@@%%%% to generate 4 lowercase letters followed by 4 digits. Combine different pattern characters (@, ,, %, ^) in a single pattern for mixed character passwords.

Analyze the policy requirements (length, character types) and create a matching pattern. For example, policy requiring 8 chars with uppercase, lowercase, digits, and symbols: use -t @@@@%%%% with appropriate character sets.

Crunch has no hard limit on output size, but generating all combinations of long passwords with large character sets creates enormous files. Always calculate output size first: charset_length^password_length equals total combinations.

Use: crunch 8 8 abcdefg | john --stdin --format=raw-md5 hashes.txt. The --stdin flag tells John to read candidates from standard input instead of a wordlist file, saving disk space.

Yes, generate 8-digit PIN lists with crunch 8 8 0123456789 and pipe to Hashcat or Aircrack-ng. Crunch is commonly used for WPA PIN recovery and testing default router passwords.

The -t flag specifies a pattern template: @ generates lowercase letters, , generates uppercase, % generates digits, and ^ generates symbols. For example, -t @@@@%%%% generates 4 lowercase letters followed by 4 digits.

Calculate total combinations: charset_length^min_length to charset_length^max_length. For 8-character lowercase: 26^8 = 208 billion combinations. Each word is 8 bytes + newline, so estimate approximately 1.7 terabytes.

Yes, include special characters in the charset string or use ^ pattern. For example: crunch 8 8 '@%^*' generates 8-character combinations from the specified symbols. Combine with letters and digits for mixed character passwords.

Use: crunch 8 8 0123456789 | aircrack-ng -b MAC -w - handshake.cap. The -w - flag tells Aircrack-ng to read from stdin, streaming Crunch output directly without creating intermediate files.

Yes, use lowercase letters as the charset: crunch 6 6 abcdefghijklmnopqrstuvwxyz -o words.txt. This generates all combinations from aaaa to zzzzz using only lowercase characters.

Use -o with a filename to save output. Crunch automatically overwrites the file. If you want to append instead, pipe output with >> to a file. Use stdout mode (no -o) for piping to other tools.

Yes, use the -t pattern flag. For example, -t company@@@@ generates 'company' + 4 lowercase letters. The @ symbol generates lowercase, % generates digits, and ^ generates symbols in the pattern.

Specify min and max length: crunch 4 8 abcdefghijklmnopqrstuvwxyz generates words from 4 to 8 characters. Each length is generated separately, starting with 4-character words and progressing to 8-character words.

No, Crunch generates all combinations with repetition by default. For non-repeating characters, you would need to post-process Crunch output or use custom scripts. Crunch is designed for maximum coverage including repeated characters.