[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1359752333.12586.21.camel@milton>
Date: Fri, 01 Feb 2013 14:58:53 -0600
From: jmk <jmk@...fus.net>
To: john-dev@...ts.openwall.com
Subject: Re: NTLMv1 and MSCHAPv2 (was: NetNTLMv1)
On Fri, 2013-02-01 at 21:22 +0400, Solar Designer wrote:
> I think the typical case is having only a relatively small number of C/R
> pairs, though. If so, our changes speed things up a lot.
Thanks for all the work on speeding this stuff up!
I capture and crack C/R pairs during nearly every one of our
assessments. That said, it's rare that I'm ever going after more than
three or four of them at any given time.
FWIW, the most common C/R that I'm seeing these days is NTLMv2, followed
by LMv1+NTLMv1. In the LMv1+NTLMv1 case, I typically RainbowCrack the
first portion of the password and then use John to get the rest. I'm not
actually seeing all that many standalone NTLMv1 responses.
Joe
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
