[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 21 May 2013 23:48:09 +0200
From: magnum <john.magnum@...hmail.com>
To: john-users@...ts.openwall.com
Subject: Re: Fuzzing with regular expressions
On 21 May, 2013, at 22:59 , Jan Starke <jan.starke@...ofbed.org> wrote:
> i've added the requested feature. rexgen is becoming a very nice tool with
> this one, so thank you for your thoughts and ideas so far
Excellent. It still builds on OSX and you seem to have fixed the other issues (like .dylib vs .so): I had a private hard-coded patch that I no longer need to apply.
> It is working, so one can test it now. But please be aware this feature is
> alpha level only: using back references and pipe references together with
> quantifiers (something like ([0-9])abcd\1{2,3}) results in a segfault. This
> is my next task for now.
>
> I kind of documented the new feature on http://code.google.com/p/rexgen/
I think you should also add the -f option to the "Which parameters are supported?" section on that page.
Thanks!
magnum
> 2013/4/20 magnum <john.magnum@...hmail.com>
>
>> The suggestion I mentioned is not on this list but in your "issues":
>> http://code.google.com/p/rexgen/issues/detail?id=5
>>
>> magnum
>>
>>
>> On 19 Apr, 2013, at 22:55 , Jan Starke <jan.starke@...ofbed.org> wrote:
>>
>>> Hi
>>>
>>> yeah, there should be a simple way of creating a C (without ++)
>> interface.
>>>
>>> Unfortunately, I have some problems reading full email threads. I must
>> work
>>> on this. If I understand you right, you want to combine another wordlist
>>> generator with rexgen, e.g. to extend simple wordlists, like this:
>>>
>>> cat wordlist.txt | rexgen 're1<pipeinput>re2' | ...
>>>
>>> I still had a similar idea, because we sometimes could need something
>> like
>>> this. I still have some work to do on the current features, but this will
>>> be the next feature.
>>>
>>> Kind regards, jan
>>>
>>>
>>> 2013/4/16 magnum <john.magnum@...hmail.com>
>>>
>>>> On 16 Apr, 2013, at 22:17 , Jan Starke <jan.starke@...ofbed.org> wrote:
>>>>> I just changed some things and was able to speed up rexgen by the
>>>>> factor of 5 (on my system) without using threads; additionally the
>>>>> ordering of the values is partly random. Maybe you want to give it a
>>>>> try...
>>>>
>>>> I am delighted to report that under OSX (built with gcc/g++) r44 is 11.5
>>>> times faster than the last version I tried (which was r24 or so).
>> Previous
>>>> speed about 2.3MB/s (405K words/s) and now over 27 MB/s (4.6M words/s),
>>>> using '[a-z]{0,5}'. This is still a bottleneck for very fast formats
>> but,
>>>> well, any way of producing candidates is and with the finer granularity
>> of
>>>> a regexp you might gain total time anyway.
>>>>
>>>>> BTW, we've been able to crack a bunch of passwords during a pentest
>>>>> with rexgen and JtR, because we had an idea about how the passwords
>>>>> could look like and we could describe this using a simple regex :-)
>>>>
>>>>
>>>> Yes, for some patterns (with variable length parts like
>> "abc[0-9]{1,3}def"
>>>> there's just no way to do it (that easily) with any other tool I know
>> of.
>>>> Not to mention wilder regexps and back references!
>>>>
>>>> Like I just wrote in another post I'd love to have this as a native mode
>>>> in JtR but we can't use C++. OTOH, maybe we can add a HAVE_REXGEN in
>>>> Makefile, stating that we have librexgen installed, and write a mode in
>> C
>>>> that just calls the lib.
>>>>
>>>> BTW did you see my suggestion of supporting append/prepend to words read
>>>> from stdin? That would be awesome.
>>>>
>>>> magnum
>>>>
>>
>>
>>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
