# Crunch

Crunch is a password generating tool that can interact with [aircrack-ng](https://reaper.gitbook.io/my-penetration-test-guide/wireless-attacks/aircrack-ng-suite/aircrack-ng "mention")like `John-the-Ripper` .

Given a pattern, any characters set, or words, it is able to generate all possible combinations.

***

## Usage

1. This tool only require us to specify 2 main paramters:

* Minimum length
* Maximum length

The command below shows how:

```bash
crunch <MIN> <MAX>
```

<figure><img src="https://581544444-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcjRnbfvT0AdEPE39KKGP%2Fuploads%2FlR2HgyxprGdyVofnPHzM%2Fimage.png?alt=media&#x26;token=eb10782c-1a68-4eaf-a2db-25033bed0648" alt=""><figcaption></figcaption></figure>

But as shown in the image above, it is NOT EFFICIENT at all to generate a wordlist that big, so we need to narrow down the domain of generating the password by providing a pattern, see the command below:

```bash
crunch <MIN> <MAX> <Character Set>
```

<figure><img src="https://581544444-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcjRnbfvT0AdEPE39KKGP%2Fuploads%2FVUVkZMKX5Hx3Je9CEldv%2Fimage.png?alt=media&#x26;token=03debab0-c90d-465e-b266-ec5595a8ad2d" alt=""><figcaption></figcaption></figure>

***

2. Now you can see how much the difference is between providing character set and not. but how to provide a pattern? check the command below:

```bash
crunch <MIN> <MAX> -t <Pattern>
```

There are several wildcards to use while generating a wordlist:

* `@` : Lower case character or from a character set
* `,` : Upper case character
* `%` : Digit
* `^` : Symbol

For example, to generate something like `Password!@34` we use the pattern `Password^^%%` (used grep just for demonstration):&#x20;

<figure><img src="https://581544444-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcjRnbfvT0AdEPE39KKGP%2Fuploads%2FZgu4CCGLU6kgNfWYDjuM%2Fimage.png?alt=media&#x26;token=8e69b67a-a3b9-47f0-b2ff-6bc7de94cde1" alt=""><figcaption></figcaption></figure>

***

3. We can also provide list of words:

```bash
crunch <MIN> <MAX> -p <word 1> <word 2> <word 3> ....
```

Check this example:

<figure><img src="https://581544444-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcjRnbfvT0AdEPE39KKGP%2Fuploads%2F3ac7nwojtav4yC009f6P%2Fimage.png?alt=media&#x26;token=d953df17-6ace-41c1-a8c7-de621d2ec778" alt=""><figcaption></figcaption></figure>

***

## Crunch with Aircrack-ng

Just like the usage with `John-the-Ripper` , we can pipe the output into the standard input of `aircrack-ng` :&#x20;

```
crunch <MIN> <MAX> -t <Pattern> | aircrack-ng -e <ESSID> -w - <Capture File>
```