Password Recovery Software

When it comes to password decryption, a hybrid dictionary attack is a very flexible and indispensable tool. Unlike a common dictionary attack, which uses a custom though, but nevertheless a fixed set of word mutation rules, a hybrid attack can be completely adjusted according to your needs.

Many users when decrypting passwords use their own password mutations rules, starting hybrid dictionary attack several times with different settings. For example, the first attack starts with the most frequently used and limited set of rules for searching popular passwords quickly, then there goes a hybrid attack rules to locate non-Latin passwords, and then a slow attack with a full set of rules for finding out all possible combinations, etc. By the way, a full collection of more than 600000 mutation rules is available at the following link: hybrid_all.ini

Often users are asking: what is the most effective rule-file in a given situation? The problem is, some sets of rules were made to search for passwords based on popular mutations, others for finding certain types of passwords. For example, like these ones:
overwrite.ini, insert.ini - search for passwords with replaced or inserted character
numbers.ini - searching for passwords with numbers at the beginning or end of a word
simple_dates.ini - searching for passwords with dates
nonenglish_words.ini - mutation of non-Latin passwords
l33t.ini - for passwords written in leet, like password -> p@$$w0rd
dotcom.ini - domains at the end of words

We tried to abstract from the fact that some sets are specific to a certain type of passwords, and tried to evaluate the effectiveness of each rule-file that comes with our Windows Password Recovery tool. We made a list of 30819 NTLM hashes taken from the Defcon Crack Me if You Can 2010 contest. Then sequentially started the hybrid attack with each (one) set to evaluate their effectiveness, check the working time, etc. The attack was carried out using the built-in wpr.pcd dictionary consisting of 5398185 words. Used hardware - Nvidia GTX 1060. The table below shows the list of the most effective sets, sorted by the maximum number of found items.

The first column shows the number of passwords found by the given set of rules. The second displays the number of found passwords in percentage. The third column shows the total number of rules for the file. In the fourth, the time took to verify all the rules. The next two columns are a little bit more interesting and output the most effective rules. More specifically, the number of found passwords for a single rule and the number of found passwords per second.

Quite funny to see the significant superiority of some sets (for example, insert.ini and overwrite.ini) and the failure of others, such as Hashcat_Incisize_leetspeak.ini. But this is understandable, taking into account that they were mainly designed to search for passwords of certain types. In general, the results can be useful for those who face strict time frames when recovering passwords. For instance, a good balanced rule set is InsidePro-HashManager.ini, which has found 5785 passwords in only 28 seconds. For comparison, the set of all mutation rules found 11248 password for ~ 1 hour using the above-mentioned hardware.

Some more additional statistics.

Top 10 best rule-sets (sorted by the number of found passwords)

Top 10 biggest rule-sets (by the number of rules)

Top 10 most efficient rule-sets (by the number of found passwords per rule)

Top 10 fastest rule-sets (by the number of found passwords in second)