[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20080828004613.GA15072@openwall.com>
Date: Thu, 28 Aug 2008 04:46:13 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: generating a wordlist with john
On Wed, Aug 27, 2008 at 08:27:39PM -0400, Adam Turk wrote:
> The reason this came up is I was reading a posting at forums.remote-exploit.org that says I could use john to generate a wordlist.
Indeed, you can.
> To find the size of a wordlist it is number of characters ^ to the length you want.
This depends on what kind of a wordlist you want. If you want all
possible combinations of characters in fixed-length strings, then that
is correct.
> If I understand this correctly, using john --incremental=All --stdout=2 will just randomly generate a combination of characters and then truncate said combination to the length specified. There is no guarantee that you would end up with every possible combination of 95 characters. The generated list could have the same word multiple times and leave some out. Is this right?
No. doc/FAQ has this entry:
Q: Are the strings tried with "-i" ("incremental" mode) random? They
certainly look like they are almost random.
A: No, they are not. No single candidate password will be tried for a
second time and the order in which they are tried is in fact very smart:
it is based on frequencies of different trigraphs, stored and processed
separately for each character position and for each password length.
It is in fact guaranteed that every possible combination will be
generated, and it is guaranteed that no combination will appear more
than once.
You were doing everything right, except that you were confused by the
absence of a minimum length constraint. I've already explained how you
can introduce one if you like (with "MinLen", with filter(), or with an
external program), although you probably don't need to (it is fine and
usually even desirable to test the shorter candidate passwords as well).
Alexander
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
