Cracking Efficiency Measurements & Common Substring Attack

The report evaluates a password-cracking methodology that mines common substrings from previously cracked passwords and uses them in hashcat’s combinator mode alongside standard wordlists and rules. Across 88 tests on multiple hash sets, the traditional rules-based approach (rockyou + hob064) slightly outperformed the substring method in overall crack rate, while the substring approach paired with facebook-firstnames and uppercase-first-letter (-jc) achieved comparable effectiveness with markedly higher hash speeds. Private, tailored wordlists outperformed public ones, and overlap analysis showed limited uniqueness between rules- and substring-based cracks, highlighting the value of diversified lists and techniques.