Your example A1B2C3D4
suggests the pattern should be ,%,%,%,%
; this is the pattern used by this other answer. Then your comment mentions %,%,%,%,
and "several like them", so probably you want to get passwords with four digits and four uppercase letters that not necessarily fit the layout of the example you explicitly gave us. The question itself does not state this clearly (and it's a shame).
In case you meant %%%%,,,,
, %%%,%,,,
and many other possible patterns covering four digits and four uppercase letters, this is how you can proceed.
The following command will generate all possible patterns meeting the criterion:
crunch 8 8 -p %%%%,,,, | sort -u
You can check (by piping to wc -l
) that there are 70 of them.
This command will run 70 additional instances of crunch
one by one, each with its unique pattern:
crunch 8 8 -p %%%%,,,, | sort -u | xargs -L 1 crunch 8 8 -t
Note you shouldn't use -o
with the second crunch
because there will be 70 of them and if you use -o
then each one will overwrite the specified file anew. To write to a file, use shell redirection:
crunch 8 8 -p %%%%,,,, | sort -u | xargs -L 1 crunch 8 8 -t > wordlist
In general you can interrupt crunch
with Ctrl+C and it will inform you where it ended, so you can resume later (if you know how; see the -s
option). In our case proper resuming would be significantly harder: we would need to resume one specific crunch
with the right pattern and then run the remaining ones in full. If you think you may want to take breaks, consider saving the patterns to a regular file and then running 70 crunch
processes in a more manual manner:
crunch 8 8 -p %%%%,,,, | sort -u >patterns<patterns sed -n '1 {p;q}' | xargs -L 1 crunch 8 8 -t > wordlist # first pattern<patterns sed -n '2 {p;q}' | xargs -L 1 crunch 8 8 -t >> wordlist # second pattern<patterns sed -n '3,5 p; 5 q' | xargs -L 1 crunch 8 8 -t >> wordlist # patterns from 3 to 5# and so on
This way you can generate the wordlist gradually and take breaks (or even reboot) between commands.
On the other hand, since crunch
uses just one CPU core (at least crunch
3.6 in Ubuntu works this way), maybe you want to run many processes in parallel. This is how you do it with GNU parallel
:
crunch 8 8 -p %%%%,,,, | sort -u | parallel --line-buffer -L 1 crunch 8 8 -t > wordlist
This can significantly speed things up, but the above exact command must do everything in one go, because resuming after Ctrl+C is virtually impossible in this case. You can however build the wordlist gradually also with GNU parallel
:
crunch 8 8 -p %%%%,,,, | sort -u >patterns<patterns sed -n ' 1, 8 p; 8 q' | parallel --line-buffer -L 1 crunch 8 8 -t > wordlist<patterns sed -n ' 9,16 p; 16 q' | parallel --line-buffer -L 1 crunch 8 8 -t >> wordlist<patterns sed -n '17,24 p; 24 q' | parallel --line-buffer -L 1 crunch 8 8 -t >> wordlist# and so on
You should not Ctrl+C any of those commands, but between commands you can postpone at will or even reboot.
Each of the 70 crunch
processes will generate over 38 GiB of output, the full wordlist
will take more than 2.6 TiB. As a proof of concept let's generate a way smaller wordlist (about 2 MiB) by using two digits and two uppercase letters:
crunch 4 4 -p %%,, | sort -u | parallel --line-buffer -L 1 crunch 4 4 -t > wordlist
Note that --line-buffer
allows lines from one instance of crunch
to be mixed (interleaved) with lines from other instances (still each line alone will be fine, boundaries will be between lines). GNU parallel
can group output from each crunch
together and this is the default behavior. Such grouping can work for this small wordlist (i.e. you can drop --line-buffer
or explicitly use --group
instead of --line-buffer
), but if you try it with our 70 crunch
processes that generate over 38 GiB of output each then your computer will possibly run out of memory; --line-buffer
there is a good thing.