Mask attack when the length of the password’s tail end is unknown

A user asked help desk to solve a problem: “there is a zip file with the password lost. The password is about 10 characters long, beginning with a string of digits (12805233), the rest is unknown. It can be letters, digits or special characters. How do I create a mask and find the password?”

That’s a piece of cake for Accent ZIP Password Recovery and its Extended (positional) mask attack.

Accent ZIP Password Recovery

4.97

Download x86 (7748 Kb)

Download x64 (9136 Kb)

You have to customize a proper set of values and then use this range in the mask to generate the unknown part of your password. That’s what it looks like: 12805233?0*s

However, there might be two cases. Let’s take a look at them.

Case 1: You have no clue what characters might be in the lost part of your password.

We’re going to have to use all kinds of printable characters here — letters, digits, special characters. Their total is 96 (ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~).

1. Let’s assign all printable characters to the charset “?0” — macro “?a”
2. Now create the following mask: 12805233?0*s
3. Define the minimum and maximum password length from 9 to, let’s say, 12 characters
4. Run your mask attack

Fig.1 Mask with a full set of printable characters

AccentZPR will generate passwords with the length of 9 to 12 characters consisting of a fixed initial part and a tail end varying within the charset of all printable characters. The program will try all such combinations.

Case 2: You know a character set your password consists of.

All the settings remain the same. Except for the charset “?0”.

Specify a character set to be used for password generation and start the search. You can use macros to enable ready-made character sets or select the relevant characters manually (for example “abcdexyz1290!+”). AccentZPR will use only these characters to generate the unknown part of the password.

Fig. 2 Extended mask with a reduced range of characters

Note the number of passwords to be verified: 255 906 vs 1 754 784. By reducing the number of characters you cut off redundant validations and save time.

See more examples of using extended mask in Passcovery programs here