[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <26c6e146d55746da3de2cf637adc4498@smtp.hushmail.com>
Date: Mon, 14 Apr 2014 02:33:31 +0200
From: magnum <john.magnum@...hmail.com>
To: john-users@...ts.openwall.com
Subject: Re: EXTRA characters.
On 2014-04-12 16:20, Adriano Di Luzio wrote:
> Hi, I’m using JtR to crack for an academic project some old Unix
> password hashes. I created my custom charset (lower alpha and
> numbers), and I was wondering about Extra characters in config.
> What does "least probable" means? How does it affect interactive
> mode? Is it better to create a custom charset having the special
> symbol I need, or using the “Extra” section?
When you build a charset file, what you really do is store character
probabilities for each position, taking preceeding characters into
account as well. This is vastly different from dumb brute force provided
you train it on real-world data. But you might be short on real-world
data and somehow know a couple of characters that should be included
even though they do not appear in your training data - and this is what
the option is for.
You can watch your charset in action using eg:
$ ./john -stdout -inc:custom | head
$ ./john -stdout=4 -inc:custom | tail
Using an alnum charset made from the Rockyou dataset, the first word
produced is "123456" (indeed a good real-world guess) while the very
last is "qxqj" when limited to four characters (the "tail" test would
take too long without a limit).
You can also check how many guesses it takes to reach a certain word, if
it's not too unprobable:
$ ../run/john -stdout -inc:lowernum | grep -nm1 '^suzuki$'
270501:suzuki
Now bump CharCount to 38 and add a line "Extra = XY" in john.conf for
that mode. It will now generate passwords using lower alpha, digits and
those two upper-case characters. Check the tail for length 4 again and
you'll see that the last candidate is YYYY. The first word containing
any of the extra characters (a single "X") is #22984 when limited to
length 4, but beyond 400 million if not (I aborted after a couple of
minutes).
BTW the "Extra" stuff is apparently b0rken in bleeding-jumbo. I'll have
a look at that.
magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
