NEW: We have a Discord server now. Click here to go there now!

NOTE: Why not use our List Manager to crack your lists? Its easy and enables better management.

NOTE: When cracking WPA/WPA2 passwords, make sure you check gpuhash.me first incase it's already been processed.

Home - Wireless Cracking - Virgin Media reduced a-z wordlists


21 Results - Page 1 of 1 -
1
Author Message
Avatar
h4x0rm1k3

Status: n/a
Joined: Wed, 30 Oct 2013
Posts: 18
Team:
Reputation: 1 Reputation
Offline
Sat, 24 Oct 2015 @ 09:50:18

Here is a link to my Mediafire folder which contains the complete list of Virgin Media reduced a-z wordlists generated using Eleadons from HF's reduced wordlist generator based on his built in rules + 1 extra which is for the words to have at least 5 minimum unique characters in them. They have been archived using 7zip & can be extracted using many different archive extractors, the complete set unpacked is 352Gb and are shrunk down to 5Gb total. Each wordlist is around 250Mb in archive form and around 14-20Gb in extracted. The following are the other rules applied (please contact me if you notice any that shouldn't apply with proof please)

Only combinations which meet these criteria will be printed:
• each character cannot appear more than 3 times
• no 3 characters in a row can be identical
• no 3 characters in a row can be sequential (abc)
• no 3 characters in a row can be reverse sequential (cba)
• character 2 is not equal to character 1
• character 2 is not +1 to character 1
• character 2 is not +2 to character 1
• character 2 is not +3 to character 1
• character 2 is not +4 to character 1
• character 2 is not +5 to character 1
• character 2 is not -1 to character 1
• character 2 is not -3 to character 1
• character 2 is not -4 to character 1
• character 3 is not equal to character 1
• character 3 is not +2 to character 1
• character 3 is not equal to character 2
• character 3 is not +2 to character 2
• character 3 is not +3 to character 2
• character 3 is not +4 to character 2
• character 3 is not +5 to character 2
• character 3 is not -1 to character 1
• character 3 is not -2 to character 2
• character 3 is not -4 to character 2
• character 3 is not -5 to character 2
• character 5 is not equal to character 1
• character 5 is not equal to character 4
• character 8 is not equal to character 6
• characters 1 and 3 and 4 are not identical
• characters 1 and 3, and 2 and 4 are not identical
• characters 2, 3 and 8 cannot be identical
• characters 3 and 5, and 4 and 6 are not identical
al
These wordlists will reduce the cracking time of Virgin media (and any other ISP that uses a-z but doesn't use i or o) by a huge amount & also save you money in the process! I will also be adding new links using multi upload sites eventually so that the files last longer therefore shouldn't need to be maintained.

I made and uploaded these lists because I found that using the generator and piping into oclhashcat would only giver me around 85000H/s whereas my R9 290X is capable of 195000 so although the lists were shrunk it would still take a lot of time. Also these lists can be kept and saved as they are archived to a total of 5Gb so saves time having to generate them over & over again!
Again, this wouldn't be possible without Eleadon so a huge thanks to him for bringing the generators to the community. So, the moment you've all been waiting for.......The link to the folder, Enjoy!

https://www.mediafire.com/folder/1u62mqa19aa9t//VMa-z



Avatar
h4x0rm1k3

Status: n/a
Joined: Wed, 30 Oct 2013
Posts: 18
Team:
Reputation: 1 Reputation
Offline
Sun, 25 Oct 2015 @ 12:22:13

I have now added this to torrents, it will be slow at 1st but if anybody has the files and wants to jump on they're more than welcome as my upload speed is slow at the moment! https://thepiratebay.gd/torrent/12626378/Virgin_media_(UK)_a-z_wordlists


Avatar
blandyuk
Administrator
Status: Trusted
Joined: Tue, 05 Jul 2011
Posts: 3205
Team: HashKiller
Reputation: 7744 Reputation
Offline
Sun, 25 Oct 2015 @ 12:25:19

Why? You can brute the reduced key-space with oclHashcat anyway using:

-1 abcdefghjklmnpqrstuvwxyz ?1?1?1?1?1?1?1?1

Key-space = (24 ^ 8) = 110,075,314,176

Storage space needed = 0MB. Plus, its faster brute-forcing the key-space rather than using disc IO from a word-list.


Please read the forum rules | Please read the paid section rules

Avatar
h4x0rm1k3

Status: n/a
Joined: Wed, 30 Oct 2013
Posts: 18
Team:
Reputation: 1 Reputation
Offline
Sun, 25 Oct 2015 @ 12:50:10

Why? It's a reduced keyspace wordlist, I can run 4 of these lists off per night where I was able to run 1 before thereby cutting the cracking time by at least 3/4's plus it can be used more than once without having to compile again. As far as i'm aware and have checked the rules apply too and using those rules has cut the complete keyspace list dramatically! The lists archived only occupy 5Gb of space, 353Gb when all unpacked so you can unpack them as required, each around 15Gb as they only take 5 mins or so to unpack.


Avatar
blandyuk
Administrator
Status: Trusted
Joined: Tue, 05 Jul 2011
Posts: 3205
Team: HashKiller
Reputation: 7744 Reputation
Offline
Mon, 26 Oct 2015 @ 09:00:10

OK, so what's the total key-space for your reduced lists with all the rules applied? I remember someone asking atom to look at doing something like this once.

I can write a "stdin" program to do this as well with oclHashcat I'll test it and it'll only be a few KB's in size.


Please read the forum rules | Please read the paid section rules

Avatar
gpuhash_me

Status: Trusted
Joined: Sun, 08 Nov 2015
Posts: 914
Team: gpuhash team
Reputation: 1584 Reputation
Online
Sun, 15 Nov 2015 @ 16:57:31

Yesterday we cracked virginmedia handshake and password was 'eeaaqwmn'.
Not sure that

• character 2 is not equal to character 1


Head of cheap publicity department
Support, discounts, free offers for HK members
BTC: 1GpuHashTYDRn3S6jbLM4YwmutU5iVCxrf

Avatar
Eleadon

Status: n/a
Joined: Wed, 11 Nov 2015
Posts: 23
Team:
Reputation: 52 Reputation
Offline
Sun, 15 Nov 2015 @ 23:19:30

The GitHub repository for the tool that generates these lists is located at:

https://github.com/wpatoolkit/Lower-Alpha-Keyspace-Reducer

so that anyone can fork it and add/change/delete their own rules in the future.

For the time being I've commented out all the...

-Character 2 is not...
-Character 3 is not...

rules because those weren't always accurate.

It's intended use is to be a pipe into hashcat...

la -6minuniques | oclHashcat64 -m 2500 cap.hccap

but you can also write wordlists to disk with...

la -6minuniques -startswithA > A.txt

with each latter of the alphabet. You can also change -6minuniques to -5minuniques if you think there may be 5 minimum unique characters.


BTC: 1JAxmj4n2pTskkK37h1pysYd2L5XjXsM3W

Avatar
ziggycat

Status: n/a
Joined: Wed, 18 Mar 2015
Posts: 48
Team:
Reputation: 42 Reputation
Offline
Fri, 08 Jan 2016 @ 16:12:38

Thought I'd make a contribution here,

I've just had a complete 'mare cracking a handshake. Although the SSID had been changed I knew it was a VM router.

Now because the SSID had been changed instead of running a straight BF attack I decided on running wordlists first.

So after the running the wordlists plus 8,9 & 10 digits etc. I decided to run the reduced keyspace script.

Based on my past experiences with VM I used B,D,F,K,M,P,R & T as my initial starting points.

la -5minunique -startswith(X) | oclhashcat -m2500 ../capture.hccap


I ran this 8 times against my subset of starting characters

Nothing found... so I ran then entirety of the remaining keysapace in full and still nothing found.
30 hours later after exhausting every possible option I had available I decided to go back and run the 8 letters I excluded from the FULL keyspace (B,D,F,K,M,P,R & T)

Low and behold in 2hrs 17mins It was cracked.

looking at one of the parameters used by the script 'no 3 characters in a row can be sequential (abc)'

This explains why it didn't find it initially. The pass was ***abcd* not just 'ABC' but 'ABCD'

So it's probably worth commenting it out of the script



Avatar
blandyuk
Administrator
Status: Trusted
Joined: Tue, 05 Jul 2011
Posts: 3205
Team: HashKiller
Reputation: 7744 Reputation
Offline
Fri, 08 Jan 2016 @ 18:05:04

Nice I'm actually working on the reduced TNCAP stdin app for oclHashcat and have it working. Using a spearate thread in the app to continously build the cache rather than relying on the stdin to request the next block of work which delays the process by having to carry on with the loop.

I'm going to work on BT and VM key-spaces next using similar code. Your addition of sequential chars will be taken into account also.


Please read the forum rules | Please read the paid section rules

Avatar
ziggycat

Status: n/a
Joined: Wed, 18 Mar 2015
Posts: 48
Team:
Reputation: 42 Reputation
Offline
Sat, 09 Jan 2016 @ 12:03:39

Nice one Blandy, I have a Thompsonxxxxx (10 hex) that I've been putting off running. This new script of yours sounds just the ticket for me to pull my finger out and have a crack at it.



Avatar
blandyuk
Administrator
Status: Trusted
Joined: Tue, 05 Jul 2011
Posts: 3205
Team: HashKiller
Reputation: 7744 Reputation
Offline
Wed, 20 Jan 2016 @ 10:19:21

OK, I have results with the stdin app now with the rules:

No more than 2 sequential chars - 012 or 9AB etc.
No more than 2 consecutive chars - 000 or 999 etc.
Double 2 consecutive chars not allowed - 6A22ECC5 would not be allowed.
Contains no more than (key-length - 1) digits - I didn't change this from a hard-coded number of 9 so will have been a higher % saving. I'll run it again.
Contains no more than 5 [A-F] chars or ?l?u chars.

The below is a run with [0-9A-F] length 8 which results in a 11.02% saving.

http://paste2.org/CdCnBmKy

For SKY routers, the digit and char count rule will not apply as the char-set is [A-Z].


Please read the forum rules | Please read the paid section rules

Avatar
ziggycat

Status: n/a
Joined: Wed, 18 Mar 2015
Posts: 48
Team:
Reputation: 42 Reputation
Offline
Wed, 20 Jan 2016 @ 13:44:56

what about this one - "kas abcd y " from a virmin router ?


Avatar
blandyuk
Administrator
Status: Trusted
Joined: Tue, 05 Jul 2011
Posts: 3205
Team: HashKiller
Reputation: 7744 Reputation
Offline
Wed, 20 Jan 2016 @ 14:14:25

The rules will have to be adapted per router as there is no "one-for-all" as it were.


Please read the forum rules | Please read the paid section rules

Avatar
john8596

Status: n/a
Joined: Sat, 06 Feb 2016
Posts: 3
Team:
Reputation: 0 Reputation
Offline
Sat, 06 Feb 2016 @ 20:54:42

Looking for secruity for:

VM840042-2G
Virginmedia7112452

Please help


Avatar
hillwalker

Status: n/a
Joined: Tue, 09 Feb 2016
Posts: 5
Team:
Reputation: 0 Reputation
Offline
Tue, 09 Feb 2016 @ 16:03:22

Thanks for sharing these :-)


Avatar
cheeseuk1989

Status: n/a
Joined: Sun, 03 May 2015
Posts: 39
Team:
Reputation: 10 Reputation
Offline
Sun, 13 Mar 2016 @ 03:33:49

I have three VM names in my "manage wireless networks" if theses are any help (amount of times i have had hubs of them)

hpzpvqvj
qnrbwfnz
dqzynqve


Avatar
Mauro75

Status: n/a
Joined: Sun, 08 May 2016
Posts: 1
Team:
Reputation: 0 Reputation
Offline
Sun, 08 May 2016 @ 20:18:08

Hey there guys ,

I'm having a hard time figuring out my neighbours pass on his VM wireless net , VM295210-2G. Would any of you guys figure this out for me please? Much appreciated!!


Avatar
kangaroot

Status: Member
Joined: Thu, 07 Dec 2017
Posts: 147
Team:
Reputation: 35 Reputation
Offline
Thu, 07 Dec 2017 @ 20:24:01

Guys, please advise. Using dictionaries kindly provided by h4x0rm1k3, I figured out that rules are not absolute correct. I obviously know that victim's password starts with 'g', only small letters and 8 char long password, but if I iterate through 'g' dictionary it finds nothing. So, obviously it is within those that were excluded by the rules. How to do I quickly generate a dictionary of those excluded by the rules?


Avatar
kangaroot

Status: Member
Joined: Thu, 07 Dec 2017
Posts: 147
Team:
Reputation: 35 Reputation
Offline
Wed, 14 Feb 2018 @ 06:39:26

Any advice on my question, please?


Avatar
kangaroot

Status: Member
Joined: Thu, 07 Dec 2017
Posts: 147
Team:
Reputation: 35 Reputation
Offline
Wed, 14 Feb 2018 @ 06:49:00

In my case rule 'character 5 is not equal to character 1' didn't work, as I have both 'n's in position 1 and 5.


Avatar
##Labster##

Status: n/a
Joined: Sat, 20 Jan 2018
Posts: 16
Team:
Reputation: 1 Reputation
Offline
Sun, 01 Apr 2018 @ 16:15:04

I know this is an old post, but I thought I would chime my "discovered keys"


virginmedia4924518 - fugfbzbn - SuperHub VMDG480
virginmedia7562960 - jpeqlmru - SuperHub VMDG480
VM1919662 - qzGdrf7s4tzr - Hub 3.0 VMDG505
VM4631855 - rcFfvnnn8vbq - Hub 3.0 VMDG505



21 Results - Page 1 of 1 -
1

We have a total of 216641 messages in 26490 topics.
We have a total of 23365 registered users.
Our newest registered member is Bhuddheghd.