[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 5 Jun 2012 10:10:53 -0600
From: Stephen John Smoogen <smooge@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Using Twitter to build password cracking wordlist
On 4 June 2012 23:46, Solar Designer <solar@...nwall.com> wrote:
> Hi,
>
> I found this via http://www.reddit.com/r/netsec/ and felt that it's
> relevant to this list, especially given that the specific example uses
> John the Ripper:
>
> http://7habitsofhighlyeffectivehackers.blogspot.com.au/2012/05/using-twitter-to-build-password.html
>
> In general, I'd like folks to start posting this kind of stuff in here,
> not just to their blogs. ;-)
>
> Alexander
Ooh I had not seen that one.
On a different dictionary hacking thing, I ran into last night... but
is probably well known except to me :).
I found that sites that use only webapps to interact with passwords
will sometimes "encode" all the possible dangerous characters to HTML
code before sending it to the crypt function. So where your dictionary
might have '123456#' the $1$ string is actually '123456#'
The bulk of them seem to be
" --> "
# --> #
& --> &
' --> '
( --> (
) --> )
with various numbers of 0's added in depending on how UTF the app is feeling :).
--
Stephen J Smoogen.
"The core skill of innovators is error recovery, not failure avoidance."
Randy Nelson, President of Pixar University.
"Years ago my mother used to say to me,... Elwood, you must be oh
so smart or oh so pleasant. Well, for years I was smart. I
recommend pleasant. You may quote me." —James Stewart as Elwood P. Dowd
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
