1 Wordlist rules syntax (hashcat extensions). 2 3John 1.9.0-jumbo-1 has added new rules syntax (and some slightly different 4rules processing logic), so that hashcat rules are handled 100% identical 5to how hashcat processes them (on CPU). 6 7New .conf file flags added. 8 9There are 2 new 'flags' added. These tell both the config loader (part of 10john which loads the .conf files), how to process things a bit differently, 11and tells the rules engine that the rules processing should be done fully 12using hashcat logic (or not). These flags are: 13 14!! hashcat logic ON 15!! hashcat logic OFF 16 17Normally, the hashcat rules files should be included into John's configuration 18and the best way to do this is to add lines to a john-local.conf file that 19you create (or update) that is either in the current working directory or 20in the run directory where the john program is located. Within this file, 21one simply creates include sections, like this: 22 23[List.Rules:HC_dive] 24!! hashcat logic ON 25.include '/code/hashcat/rules/dive.rule' 26!! hashcat logic OFF 27 28[List.Rules:HC_deadone] 29!! hashcat logic ON 30.include '/code/hashcat//rules/d3ad0ne.rule' 31!! hashcat logic OFF 32 33... etc. 34 35Within hashcat mode, there is no rules preprocessor. So rules such as [ and ] 36which would NORMALLY require quoting such as \[ or \] no longer require 37quoting. Also, there are no 'character classes' within hashcat logic, so 38the ? will be usable as is : such as $? where in John's normal rules, this 39would have to be $?? (for class ?) 40 41Note, the "!! hashcat logic ON" / "!! hashcat logic OFF" do not have to 42be used right before/after a .include statement. However, be very cautious 43when using '!! hashcat logic ON' pragma lines, as this will cause the 44.conf file loading to fail to load sections, and has other strange side 45effects, if the '!! hashcat logic OFF' is not present, and there might be 46few or no immediately obvious side effects, other than sections which are 47expected to be seen or options that are expected to be changed, are NOT showing 48up or working. 49 50 51 New rules added (many work fine outside of hashcat logic sections). 52 53+-------+------------------+-------+------------+------------------------+-----+ 54| Rule | Explanation |Example| Input data | Output Data |notes| 55+-------+------------------+-------+------------+------------------------+-----+ 56| pN | Dup word N times | p2 | P@ss | P@ssP@ssP@ss | 23 | 57+-------+------------------+-------+------------+------------------------+-----+ 58| RN | bitshift right | R2 | P@ss | P@9s | 24 | 59+-------+------------------+-------+------------+------------------------+-----+ 60| LN | bitshift left | L1 | P4ss | Phss | 24 | 61+-------+------------------+-------+------------+------------------------+-----+ 62| k | swap first 2 | k | P@ss | @Pss | 1 | 63+-------+------------------+-------+------------+------------------------+-----+ 64| K | swap last 2 | K | P@sS | P@Ss | 1 | 65+-------+------------------+-------+------------+------------------------+-----+ 66| *NM | swaps N with M | M*0m | P@sS | S@sP | 1 | 67+-------+------------------+-------+------------+------------------------+-----+ 68| +N | increment char | +1 | P@sS | PAsS | 25 | 69+-------+------------------+-------+------------+------------------------+-----+ 70| -N | decrement char | -1 | P@sS | P?sS | 1 | 71+-------+------------------+-------+------------+------------------------+-----+ 72| 4 | append memory | uMl4 | P@ss | p@ssP@SS | 1 | 73+-------+------------------+-------+------------+------------------------+-----+ 74| 6 | prepend memory | uMl6 | P@ss | P@SSp@ss | 1 | 75+-------+------------------+-------+------------+------------------------+-----+ 76| ONM | Omit range | O34 | 012345678 | 01278 | 1 | 77+-------+------------------+-------+------------+------------------------+-----+ 78| zN | dupe 1st char | z2 | P@sS | PPP@sS | 1 | 79+-------+------------------+-------+------------+------------------------+-----+ 80| ZN | dupe last char | Z2 | P@sS | P@sSSS | 1 | 81+-------+------------------+-------+------------+------------------------+-----+ 82| .N | replace char N | .2 | P@sS | P@SS | 1 | 83| | with next char | | | | | 84+-------+------------------+-------+------------+------------------------+-----+ 85| ,N | replace char N | ,2 | P@sS | P@@S | 1 | 86| | with prior char | | | | | 87+-------+------------------+-------+------------+------------------------+-----+ 88| yN | duplicate first | y2 | P@sS | P@P@sS | 1 | 89+-------+------------------+-------+------------+------------------------+-----+ 90| YN | duplicate last | Y2 | P@sS | P@sSsS | 1 | 91+-------+------------------+-------+------------+------------------------+-----+ 92| E | Title case | E | test word | Test Word | 1 | 93+-------+------------------+-------+------------+------------------------+-----+ 94| q | dupe all chars | 1 | P@sS | PP@@ssSS | 1 | 95+-------+------------------+-------+------------+------------------------+-----+ 96 97Notes: 981. works fully without being in hashcat mode 992. works to a limited extent without being in hashcat mode 1003. p in non hashcat mode is pluralize. If p is followed by 0 to 9, then it is 101 treated as the hashcat duplicate word, even if not in HC mode. 1024. R and L are keyboard shift R and L if not in hashcat mode. But in hashcat 103 mode, these are bitshift character at location N. If R or N are followed by 104 0 to 9 in non hashcat mode, then they are treated as the hashcat rules. 1055. +N does not work in single mode, unless hashcat logic is used. 106