[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <efec207ae76bb1f6331ea2f035779406@smtp.hushmail.com>
Date: Thu, 28 Jun 2012 03:18:41 +0200
From: magnum <john.magnum@...hmail.com>
To: john-dev@...ts.openwall.com
Subject: Re: --regen-lost-salts (was: 'New' functionality added
to JTR (finding salted passwords, without salts))
On 2012-04-20 01:13, Frank Dittrich wrote:
> On 04/20/2012 12:34 AM, jfoug wrote:
>> Well, the 2 formats I have been working on are: PHPS/dynamic_6, which is
>> md5(md5($p).$s) with 3 byte salt, and osCommerce (dynamic_4), md5($s.$p)
>> with a 2 byte salt. Both of these formats have salt values from a space
>> char, up to 0x7e (the '~' tilde char). From some initial testing, I found a
>> lot of the PHPS (I have about 800k of them), and also there are a lot of
>> OSCommerce (I am just starting to collect them).
>
> That's interesting. But under normal circumstances, you probably
> wouldn't throw away the salt. (Or are there systems which compute the
> hash with a rendom salt, but don't store the salt?
The one who dumped the hashes might have missed that database column
just out of cluelessness. Or for some reason you could not get the salts
during a pen-test.
> After cracking several passwords, did you detect any patterns, i.e.,
> non-random salts?
> Either a non-uniform distribution of salts, or a salt which (due to a
> broken implementation) based on the password?
I saw non-uniform distribution for sure. I never got to test this
curious feature until now, when testing that last BSS patch. It's pretty
cool and faster than I thought. I ran password.lst on the first 10
million lines in the KoreLogic md5 file, like this (btw -wo now defaults
to password.lst):
$ head -10000000 test/hashes/raw-md5.hashes.txt > regen-test.md5
$ ./john regen-test.md5 -fo:osc --regen-lost-salts=2 -wo -nolog
...
guesses: 14369 time: 0:00:00:21 DONE (2012-06-28 03:16:28) c/s: 13573G
trying: princesa - hallo
magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
