[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <55A67461.4030207@mailbox.org>
Date: Wed, 15 Jul 2015 16:55:29 +0200
From: Frank Dittrich <frank.dittrich@...lbox.org>
To: john-dev@...ts.openwall.com
Subject: Re: Default attack format
On 07/15/2015 04:33 PM, magnum wrote:
> I believe the ultimate answer is "the first format that was registered
> [as in fmt_register()] who's valid() doesn't reject all hashes in the
> file".
>
> For example, LM and various NT alternatives will accept hashes in pwdump
> format. LM is registered before NT, so LM wins. I think this is true
> even for files that eg. contain both LM and NT and where all uncracked
> ones are the latter. It will still pick LM, and say all (of them) were
> cracked.
>
> The output of --list=formats is currently in register order.
Actually, no.
The loader processes all the hashes in the input file(s) sequentially.
For each hash, it tries all the format implementations in the sequence
they were registered (i.e., the seuence they appear in --list=formats or
--list=format-details...).
The first format finding a valid hash wins:
$ ./john hashes.LM hashes.md5crypt
Warning: only loading hashes of type "LM", but also saw type "md5crypt"
Use the "--format=md5crypt" option to force loading hashes of that type
instead
Warning: only loading hashes of type "LM", but also saw type "aix-smd5"
Use the "--format=aix-smd5" option to force loading hashes of that type
instead
Using default input encoding: UTF-8
Using default target encoding: CP850
Loaded 9 password hashes with no different salts (LM [DES 128/128 AVX-16])
Warning: poor OpenMP scalability for this hash type, consider --fork=8
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
(?)
AAAAAAA (?)
AAAAAA (?)
ZZZZZZ (?)
4g 0:00:00:00 0.00% 3/3 (ETA: 16:50:36) 7.017g/s 124601p/s 124601c/s
852959C/s 123456
Use the "--show" option to display all of the cracked passwords reliably
Session aborted
$ rm john.pot
$ ./john hashes.md5crypt hashes.LM
Warning: only loading hashes of type "md5crypt", but also saw type "LM"
Use the "--format=LM" option to force loading hashes of that type instead
Warning: only loading hashes of type "md5crypt", but also saw type
"dynamic=md5($p)"
Use the "--format=dynamic=md5($p)" option to force loading hashes of
that type instead
Using default input encoding: UTF-8
Loaded 26 password hashes with 23 different salts (md5crypt, crypt(3)
$1$ [MD5 128/128 AVX 4x3])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
12345678 (?)
(?)
(?)
password (?)
test (?)
password (?)
1234 (?)
john (?)
ripper (?)
test1 (?)
the (?)
11g 0:00:00:01 6.80% 2/3 (ETA: 16:51:25) 9.016g/s 7554p/s 121809c/s
122754C/s blisses..lotuses
Use the "--show" option to display all of the cracked passwords reliably
Session aborted
The format that gets used will be saved in the .rec file, in the log
file, and on standard output (The "Loaded ..." line).
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
