[Bruteforce] math calculation

[pierre]

Hello,

I have a doubt on a math calculation regarding bruteforce operation.

If I have to look for credential (login+password) between 6 and 8 characters long, mixing lowercase/uppercase/numeric, the right number of possibilities is:

P = [(26+26+10)6 + (26+26+10)7 + (26+26+10)8] * 2 ?

Thanks :)

Edited February 28, 2018 by pierre

[digininja]

I wasn't great at maths stats at college but isn't it:

Number of possible characters in first position = 26+26+10 = 62

For a one character password there would be 62 different possbilities

For two chars: 62 * 62 = 62 ^ 2

Three chars: 62 ^ 3

...

Six chars: 62 ^ 6

Seven chars: 62 ^ 7

Eight chars: 62 ^ 8

For 6, 7 or 8 chars: (62 ^ 6) + (62 ^ 6) + (62 ^ 8) = 221918520426688 =  221,918,520,426,688

So yes, I'd agree that you got it right.

[pierre]

Ok we agree for determining a single word, login or password.

But now the number of possibilities for the combination of credentials login:password, that are between 6 and 8 characters long, is:

P = [(62 ^ 6) + (62 ^ 6) + (62 ^ 8)] x 2 ?

[digininja]

Yes, that sounds right.

I am wondering though whether you should actually combine the two so you actually have a string that is between 12 and 16 characters and do the maths on that but I don't think that would be right.