generate-hashcat-toggle-rules.py is a Python program to generate hashcat toggle rules. Toggle rules toggle the case of letters in words present in a dictionary.
Hashcat comes with toggle rule files for candidate passwords up to 15 characters long. There’s a rules file that will toggle exactly one letter (toggles1.rule), another rule file for up to two letters (toggles2.rule), three, four, and finally a rule file for up to five letters (toggles5.rule). Hashcat does not provide rules with more than five toggles, as empirical data shows that passwords chosen by users only contain a couple of uppercase letters.
These toggle rule files can also be generated with generate-hashcat-toggle-rules.py.
This command generates rules identical to toggles5.rule:
But I want to crack NTLM hashes for randomly generated passwords, and for which I already cracked the LM hash. So I must toggle up to 14 letters. I can use the following command to generate this toggle rule file:
generate-hashcat-toggle-rules.py -n -p 14 14 > toggles-lm-ntlm.rule
-n will include rule :. This rule makes no changes (nothing) to the candidate password. This way I can run hashcat only once with the rule file. I don’t need to run hashcat with and without rule file.
-p 14 generates toggles up to position 14 (the default is up to position 15, but since LM hash passwords are maximum 14 characters long, it’s useless to generate toggles for position 15).
Here is part of this generated file toggles-lm-ntlm.rule:
: T0 T1 T2 T3 T4 T5 T6 T7 T8 T9 TA TB TC TD T0T1 T0T2 T0T3 T0T4 T0T5 ... T1T3T4T5T6T7T8T9TATBTCTD T2T3T4T5T6T7T8T9TATBTCTD T0T1T2T3T4T5T6T7T8T9TATBTC T0T1T2T3T4T5T6T7T8T9TATBTD T0T1T2T3T4T5T6T7T8T9TATCTD T0T1T2T3T4T5T6T7T8T9TBTCTD T0T1T2T3T4T5T6T7T8TATBTCTD T0T1T2T3T4T5T6T7T9TATBTCTD T0T1T2T3T4T5T6T8T9TATBTCTD T0T1T2T3T4T5T7T8T9TATBTCTD T0T1T2T3T4T6T7T8T9TATBTCTD T0T1T2T3T5T6T7T8T9TATBTCTD T0T1T2T4T5T6T7T8T9TATBTCTD T0T1T3T4T5T6T7T8T9TATBTCTD T0T2T3T4T5T6T7T8T9TATBTCTD T1T2T3T4T5T6T7T8T9TATBTCTD T0T1T2T3T4T5T6T7T8T9TATBTCTD
The generated toggle rule file toggles-lm-ntlm.rule is included in the ZIP file: