Hybrid attack — Comprehensive operation

Project reference document Time2Crack

Recipients: developers, security researchers, advanced users

Contents

1. Overview

Hybrid attack is the cracking method that combines a dictionary wordlist with a set of transformation rulesInstead of testing each word in the dictionary as it is (pure dictionary attack), it generates on the fly all plausible variants of each word — capitalizations, character substitutions, prefix/suffix additions, inversions — and systematically tests them.

Hybrid attack is historically the responsible method for the majority of real "mean" password crackings — those that appear to be strong without being strong. According to Ma et al. (2014, IEEE S&P), the first 8 to 10 rules applied to a current word suffice to crack the median password population.

In Time2Crack, the hybrid attack modeled:

2. Historical and academic background

2.1 Origins: John the Ripper and mutation rules

The hybrid attack is formally born with John the Ripper (Solar Designer, 1996), the first public tool to combine a wordlist with a configurable rule engine. Prior to John the Ripper, dictionary attacks tested raw words; John introduced the notion that each word generates a family of candidates.

2.2 Founding empirical studies

• Rule 1 (: → mot brut) : crack 18% of dict-based passwords

2.3 LinkedIn flight as a school case

The 2012 LinkedIn leak (6.5 million non-salted SHA-1s) perfectly illustrates the power of the hybrid. In 72 hours, the hashcat community had cracked:

Post-crack analysis revealed that "linkedin1", "Linkedin1", "l!nked!n" and "LINKEDIN" — all variants of "linkedin" — collectively represented tens of thousands of compromised accounts.

3. Conceptual Foundations: Why the Hybrid Works

3.1 The human behaviour of "secure"

When a system imposes rules of complexity (majuscule, number, symbol), users do not generate random — they apply predictable transformations to memorizable words :

These transformations seem creative to the user. exactly the first ones that the attacker tries They correspond to the constraints imposed by security policies.

3.2 The concept of efficient reduced space

A 10-character password with letters+digits+symbols has a raw keyspace-force of 94^10, 5,4 × 10^19 combinations. Too large to travel in a reasonable time.

But if this password is "Password1!" — a trivial transformation of "password" — it is among the 500 first candidates The attacker does not travel 5.4 × 10^19 combinations: he travels 500.

This is the fundamental reduction of the hybrid attack: the real space of human choices is astronomically smaller than the theoretical space of possible characters.

3.3 The Law of Power of Transformation

Just as raw passwords follow a law of power (Zipf), the transformations that humans apply also follow a very concentrated distribution. Ma et al. (2014) empirically showed:

This concentration allows a set of 64 well chosen rules (best64) to reach a coverage of 79-85%, where 64 random rules would reach only 10-15%.

3.4 Interaction with the popularity of the basic word

The more common the base word, the earlier the derived password is in the attacker's priority list. The attacker orders his candidates in decreasing probability:

Candidats générés par l'attaquant (ordre de test) :
password (gross, most common word)
Password (capitalize first)
password1 ($1)
PASSWORD (uppercase all)
password! ($!)
p@ssword (substitute a→@)
passw0rd (substitute o→0)
Password1 (c + $1)
P@ssword (c + s a @)
password123 ($12$3)
...
p@ssW0rd! (combination complex)

"password" is the most common word → its derivatives are tested first. "papillon" is less common → its derivatives are tested much later. This prioritization is the central mechanism that explains the three distinct keyspaces in Time2Crack.

4. Architecture of a modern hybrid attack

4.1 General pipeline

Phase 1 : Sélection de la wordlist
    ├── Passwords fuités triés par fréquence (RockYou, HIBP, Collections)
    ├── Dictionnaire linguistique (fr.txt, en.txt, de.txt...)
    ├── Wordlists thématiques (prénoms, villes, marques, séries TV)
    └── Wordlists contextuelles (domaine cible, noms d'employés, termes métier)
Phase 2: Selection of the Rules Game
- - best64.rule (balanced reference, 64 rules)
OneRuleToRuleThemAll.rule (52,000 rules, ML-generated)
D3ad0ne.rule (34,000 rules, empirical)
- JtR rules (generalized.rule, specific.rule, extra.rule)
- - Custom rules (adapted to the target domain)
Phase 3: Expansion (wordlist × rules)
For each word w in wordlist:
For each rule r in ruleset:
│ applicant = application(r, w)
Promotional │ If candidate 
Promotional │ queueof thecandidates.push(candidate)
--Order: (w1, rule1), (w1, rule2)... (w2, rule1)...
or: (w1, rule1), (w2, rule1)... according to strategy
Phase 4: Haching and Comparison (GPU)
- - Sending by batch of ~10M candidates to the GPU
- - Parallel calculation of hashs (SIMD, 168 GH/s for MD5)
- Comparison with target hash(es)
If match: FINDED — log(candidate, hash, rule)
Phase 5: Reporting
- - Cracked candidate + rule used + rank in list

4.2 Hashcat modes of operation

Hashcat implements the hybrid in two distinct ways:

hashcat -a 0 -m 0 hashes.txt rockyou.txt -r best64.rule

hashcat -a 6 -m 0 hashes.txt wordlist.txt ?d?d?d?d
Test "sunshine0000", "sunshine0001", ..., "sunshine9999"

hashcat -a 7 -m 0 hashes.txt ?d?d wordlist.txt
Test "00sunshine", "01sunshine", ..., "99sunshine"

Time2Crack mainly models the mode -a 0 (transfer rules), which covers the vast majority of actual hybrid attacks documented.

4.3 Order of candidates and prioritization strategy

The order in which candidates are tested is critical.

(W1, R1), (W1, R2), ..., (W1, Rn), (W2, R1), (W2, R2)...

(W1, R1), (W2, R1), ..., (Wm, R1), (W1, R2), (W2, R2)...

In practice, hashcat uses word-first by default but experienced operators choose according to the target profile.

5. Sets of mutation rules

5.1 Syntax of hashcat rules

The hashcat rules are expressed in a minimum language where each character represents an operation on the candidate string:

5.2. Composite rules

Rules can be chained on a single line to create complex transformations:

c $1          → "Password1" (capitalize + append 1)
c $! $1       → "Password!1" (capitalize + append ! + 1)
s a @ s e 3   → "p@ssw3rd" (substitute a→@ et e→3)
r $1          → "1drowssap" (reverse + append 1)
u $2 $0 $2 $3 → "PASSWORD2023" (uppercase + append year)

Power is in the composition: 64 simple rules generate thousands of distinct transformations by combination.

5.3 Main Rules

6. Best64 rules: the reference game

Best64 is the set of 64 standard rules of reference in academic literature and industry. Here are the most important rules and their empirical justification:

6.1 The 20 most effective rules (in order of performance)

6.2 Why are these rules so effective?

Each top-10 rule corresponds to a common security policy constraint:

Password policies do not really increase security if users implement predictable transformations — they only move passwords to the second or third rule of best64.

7. Complete Taxonomy of Transformations

7.1 Category 1: Case transformations

Most common. Exploit the obligation to have a capital capital:

7.2 Category 2: Digital Suffixes and Prefixes

Exploit the obligation to have a figure:

7.3 Category 3: Leet substitutions

Systematic replacement of letters with similar numbers or symbols:

Combined substitutions ("P@ssw0rd") appear complex but are generated in a few rules: c s a @ s o 0They are among the 500 first candidates On "password".

7.4 Category 4: Symbolic Suffixes

Exploit the obligation to have a special character:

7.5 Category 5: Structural transformations

Less frequent but useful for some profiles:

7.6 Category 6: Compound transformations (advanced level)

Complex rules combine several operations:

c $1 s a @        → "P@ssword1" (capitalize + append 1 + substitute a→@)
u $! $1 $2 $3     → "SUNSHINE!123" (uppercase + append !123)
r c $1            → "Drowssap1" (reverse + capitalize + append 1)
s e 3 s a @ c $!  → "P@ssw3rd!" (multiple substitutions + capitalize + !)

These transformations seem very complex but remain detectable by a good set of rules. OneRuleToRuleThemAll contains thousands of these.

8. Frequency Priority: The Heart of Effectiveness

8.1. The frequency of the basic word determines the priority

An intelligent attacker does not apply the rules uniformly to all words. He prioritizes:

This strategy is implemented in hashcat via the sorting of the wordlist by decreasing frequency combined with the word-first strategy. It explains why "Password1" (derived from "password", the word #1) is cracked in milliseconds, while "Soleil1" (derived from "sun", word ~5000 from the French dictionary) may take a few seconds.

8.2 Median position in search space

The key measure is the median number of candidates tested before finding the target password. Ma et al. (2014) provide empirical measurements:

These measurements are the direct basis of Time2Crack constants:

const HYBRIDKEYSPACECOMMON = 500;    // Ma et al. 2014 — médiane top-100
const HYBRIDKEYSPACEDICT = 8000; // Ma et al. 2014 — median current dictator
const HYBRIDKEYSPACEFULL = 128e6; // Gosney 2012 — best64 × 2M exhaustive words

8.3 Conditions necessary for the hybrid to be applicable

Hybrid attack requires the password to be structurally derivable from a dictionary wordTime2Crack detects this condition via hybridVuln :

const hybridVuln = dictWord || (common && /[a-z]/i.test(pw));

If dictWord neither hybridVuln are true — the password contains no detectable dictionary root — hybrid attack returns null (not applicable). A purely random password like "xK9#mQ7@" is not vulnerable to hybrid.

9. Implementation in Time2Crack: addHybridAttacks()

9.1 Complete annotated code

function addHybridAttacks(rows, hybridVuln, weak, common, dictWord) {
  if (hybridVuln || weak) {
    // Sélection du keyspace selon la popularité du mot de base :
    // common → mot dans HIBP top-400 → position ~500 dans la liste de l'attaquant
    // dictWord → mot dans la wordlist → position ~8000
    // sinon (hybridVuln sans dictWord ni common) → scan exhaustif ~128M
    const hybridKS = common ? HYBRIDKEYSPACECOMMON
dictWord? HYBRIDKEYSPACEDICT
: HYBRIDKEYSPACEFULL;
for (const a of ALGOS) {
rows.push({
atk: t("aHybrid"),
hash: a.name,
rate: a.rate,
// budgetTime : the keyspace IS the number of guesses — no division by 2
// (unlike BrutTime, here candidates are ordered by probability)
dry: weak ? weakGuessTime(a.rate): budgetTime(hybridKS, a.rate),
note: weak ? t("nWeakPassword") : t("nDictMut")
cat: "hybrid",
});
}
} else {
// Password without structure dictionary → hybrid inapplicable
rows.push({
atk: t("aHybrid"),
hash: "(all)",
rate: 0,
dry: null, // N/A in the table
note: t(nStructUnrecog),
cat: "hybrid",
});
}
}

9.2 budgetTime vs bruteTime

The distinction between the two functions is fundamental:

// bruteTime : l'attaquant ne sait pas où est le mot de passe dans l'espace.
// Il teste en moyenne la moitié avant de le trouver. → keyspace/2
function bruteTime(keyspace, rate) {
  const ls = Math.log(keyspace / 2) - Math.log(rate);
  return Math.exp(ls);
}
// budgetTime: the attacker tests candidates in descending order of probability.
// Keyspace IS the number of candidates expected before finding (median position).
// No division by 2 — the median is already incorporated into the Ma 2014 constants.
budget functionTime(guess, rate) {
const ls = Math.log(guesses) - Math.log(rate);
returns Math.exp(ls);
}

For the hybrid, budgetTime is correct because the 500/8000/128M candidates are empirical estimates of the median position, not total space to travel.

9.3 Relationship with isDictWord()

Detection dictWord which conditions the choice of hybrid keyspace is produced by isDictWord() :

function isDictWord(pw) {
  if (!DICTWORDS || !DICT(WORDS.size) return false;
const l = pw.normalize("NFC").toLowerCase();
// Direct test: Is the password as it is in the dictionary?
if (DICT)WORDS.has(l)) return true;
// Leetified test: "s0le1l" → "sun" in the dico?
const dl = deLeet(pw);
if (dl!)WORDS.has(dl) return true;
// Test substring: "sunshine123" contains "sunshine" in the dico?
for (const w of DICTWORDS) {
if (l.includes(w) && w.length >= 4) return true;
}
return false;
}

This detection determines not only whether the hybrid is applicable, but also which keyspace (common vs dict) is used to calculate time.

10. The three hybrid keyspaces and their justification

10.1 HYBRIDKEYSPACECOMMON = 500

10.2 HYBRIDKEYSPACEDICT = 8,000

10.3 HYBRIDKEYSPACEFULL = 128,000,000

11. High fidelity calibration

11.1 Role of high fidelity mode

When high fidelity mode (HF) is activated in Time2Crack, an additional multiplier is applied to the calculated times to refine accuracy. For hybrid attack, this multiplier takes into account factors not captured by the basic keyspaces.

HF multiplicators for hybrid

In applyHighFidelityCalibration() :

case "hybrid":
  // Mots très courants : crackés encore plus tôt que la médiane Ma 2014
  // car les attaquants modernes trient word-first + règle-first simultanément.
  // Réduction de 30% sur les temps déjà courts.
  m = context.common ? 0.7
: context.dictWord ? 0.8
- 1.0;
Break;

11.3 Interaction with the monotony guard

The monotony guard ensures that no specialized attack claims to be faster that the raw force on the alphabetical substring of the password:

// Pour chaque row non-brute :
const floorAlpha = bruteTime(Math.pow(26, alphaOnly.length), algo.rate);
if (row.sec < floorAlpha) row.sec = floorAlpha;

For short words (e.g., "cat" = 3 letters, floor = 26^3/rate

12. Relationship with derived attacks

12.1 Hybrid vs. Pure Dictionary

12.2 Hybrid vs Rule-Based

The rule-based attack in Time2Crack is conceptually similar but with a much wider set of rules:

const RULEKEYSPACE = 250000000; // vs 128M for full hybrid

The difference: the best64 model hybrid (64 rules, focus on common human transformations). The rule-based attack models wider games like d3ad0ne (34k rules) or OneRuleToRuleThemAll (52k rules), used when best64 fails. The rule-based is the "second line" hybrid — slower but more comprehensive.

12.3 Hybrid vs PCFG

PCFG (Probabilistic Context-Free Grammar, Weir 2009) models the grammatical structure of the password to generate candidates.

PCFG can attack passwords without root dictionary if their structure is common (ex: "Thelonious8" → no word of the dico but structure Capitalize+lower+digit very predictable).

12.4 Hybrid vs Morphological (morph)

The morphological attack tests linguistic variants (flexions, variations). It is a generalization of the hybrid for languages with rich morphology:

The hybrid operates on the surface of the word (character transformations), the morphological operates on the lexical structure (derivation, bending), and they are complementary.

13. Benchmarks by hash algorithm

13.1 Time for the three hybrid keyspaces (12× RTX 4090)

13.2 Impact of the attacking profile

Time2Crack offers two profiles (Experienced 12 GPU, Professional 100 GPU). For the hybrid, the profile difference is directly proportional:

For MD5, SHA-1, NTLM: the profile changes the time from microseconds to nanoseconds — without any practical impact, both are instantaneous.

14. Concrete examples of hybrid cracking

14.1 Example 1: "Password1" (COMMON)

14.2 Example 2: "Sun2024" (DICT)

14.3 Example 3: "p@pillon!" (DICT with substitutions)

14.4 Example 4: "xK9#mQ7@" (resistant)

This password cannot be cracked by hybrid attack. It has no dictionary root. The attacker must use pure brute force, PCFG or statistical attacks (Markov, Neural).

14.5 Example 5: "LinkedInB3st!"

Interesting case: the password contains two roots ("linkedin" and "best" via de-leetification). Hybrid attack is applicable because at least one root is detected. In practice, a combinator attack (two words glued) would be even more effective here.

15. Hybrid Attack Limits

15.1 Intrinsic limits

15.2 What Time2Crack does not capture

15.3 Cases where the hybrid is overestimated

Time2Crack can overestimate hybrid speed in two cases:

16. Effective defences

16.1 What resists hybridization

Hybrid attack fails if the password does not derive from any existing dictionary wordEffective strategies:

16.2 What is NOT Resistance to Hybrid

The most common "strengthening" strategies do not resist:

16.3. Resistant hash algorithms

Even if a password is vulnerable to the structural hybrid, the hash algorithm can make the attack economically inviable:

16.4 Practical recommendations

17. References

Academic publications