[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAMGgT5C0i07bVFdTggZpubKBs1wQfEAcgsxx3nOo40C7CeRqXQ@mail.gmail.com>
Date: Fri, 21 Aug 2015 11:11:28 +0200
From: François <francois.pesce@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Anyone looked at the Ashley Madison data yet?
Thanks for this tip. I'll try it.
Sorry for the abusive password post, the goal was to provide a various
sample of how easy/complex passwords can be found using a
re-constructed gecos and the -single mode of john:
If it wasn't for the horribly slow cost 12 of bcrypt, that leak would
be an amazing source of analysis for password forging, as it contains
birthdates (where at least the year seems to be reliable), and
country/city too.
I think if I've some time this week-end, I'll try to curate the huge
pseudo-gecos file I have built to remove admin/bot account and
non-active/engaged users (no picture, single-day login/last-activity,
not-verified mail, etc.) and to focus on accounts where we can
reliably trust user-submitted information to try to forge a "smart"
cracking dictionary per-user (with mixed default passwords/single
rules applied to user account).
Francois Pesce
On Fri, Aug 21, 2015 at 6:13 AM, Solar Designer <solar@...nwall.com> wrote:
> On Thu, Aug 20, 2015 at 01:15:00PM +0200, Francois wrote:
>> I've got ~300 passwords cracked after 12 hours using single mode cracking.
>
> Without interrupting that session (as you won't be able to continue it
> without losing a lot of work, because of how "--single" mode works), you
> may, as an experiment, start another one (perhaps on another machine)
> with single.c: single_process_buffer() patched as follows:
>
> Change line "if (guessed_keys->count)" to "if (0)". This prevents
> cracked passwords from being tested against other (unrelated) salts.
> Normally, "--single" mode does this, often with much success, but here
> the number of salts might be so large that this is limiting the variety
> of candidate passwords being tested early on. With this change, you
> might receive a greater variety of cracks across the two sessions early
> on (but after a while they'll start to overlap more, wasting CPU time).
>
> In fact, it makes more sense to run this patched version only, and then
> separately check the cracked passwords against other salts in wordlist
> mode (uniq and sort the wordlist based on the number of cracks so far).
>
>> Examples of password found by single mode here:
>
> I understand that all of these must have been in plaintext form
> elsewhere in the dump or you wouldn't have cracked them yet, and you
> merely matched them against specific hashes and you wisely did not
> include that detail in here. So it's not a big deal. Yet let's not be
> posting such material in here. I think sorted "top N" lists are fair
> game (when you or someone else comes up with those), but these random
> samples are better kept off this list (you may blog and link, though) or
> someone might end up asking for a john-users posting to be censored.
>
> Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
