[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 9 May 2013 12:15:57 -0600
From: Stephen John Smoogen <smooge@...il.com>
To: john-users <john-users@...ts.openwall.com>
Subject: Re: Cracking "Correct Horse Battery Staple" in JtR
On 9 May 2013 11:57, Matt Weir <cweir@...edu> wrote:
> I was wondering if there was a built in way to crack "random word"
> passwords in JtR. For example Diceware generated passwords, or
> http://xkcd.com/936/
>
> In the past I've used a custom script combined with JtR's -stdin option to
> combine words from a dictionary but it would be nice if there was a
> ruleset, (I'm not sure if the Memory access rules could accomplish this),
> or an external mode that could do this.
>
> Thanks,
> Matt
>
Well I don't think one would gain anything from a smart "incremental" mode
as implemented as there shouldn't be any common "words" if the diceware is
being used correctly. However some sort of external mode could possibly be
written that would store the words and then do a dumbforce incremental of
them. The main things would be then to know how many words were being used
in the generating dictionary. The larger the dictionary, the harder it is
search the entire space within any reasonable amount of time.
The reason I would go for external over a ruleset is that it doesn't scale
very well. Take your dictionary you are using and just combine 2 words
together and say output Az"word1word2" instead of the words.. then look at
the size of the conf file that would be created. All those rules are read
into memory so and you end up with a log file that is as large as every
rule you have.. if not more.
--
Stephen J Smoogen.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
