[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150921140751.GA8250@openwall.com>
Date: Mon, 21 Sep 2015 17:07:51 +0300
From: Solar Designer <solar@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: Re: Judy array
On Mon, Sep 21, 2015 at 06:18:34AM -0700, Fred Wang wrote:
> Here go (you know you can run mdxfind too - I won't be offended :-)
>
> https://www.sendspace.com/file/v04opu
Preliminary analysis:
There are no hashes that JtR cracked and MDXfind did not.
There are 947 hashes that MDXfind cracked and JtR did not. The
corresponding passwords are of at least 7 characters long (none are
shorter than 7). No other obvious pattern yet. I've tested a couple
against john --stdout for the same wordlist and rules, and they are not
in there, so at least for these two it's some discrepancy in the
candidates stream rather than in the hashing or comparisons. One such
password is noimage. A similar line in the wordlist is geoimagen,
although there are several other (not so) similar ones. A rotate rule
might be producing noimage on MDXfind, but somehow not on JtR.
For 133156 cracked hashes MDXfind reports passwords different than JtR
does. Out of those, 110206 appear to be truncated and 22950 appear to
use $HEX[] unnecessarily (and are in fact misreported if we interpret
those embedded NULs and what follows as part of passwords, which they
actually are not). The corresponding passwords reported by JtR look
correct. I only tested maybe 10 of them, though.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
