[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20090215143434.GA5172@openwall.com>
Date: Sun, 15 Feb 2009 17:34:34 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Broken long/double DES hash split
On Sun, Feb 15, 2009 at 01:04:46AM -0600, Joshua J. Drake wrote:
> With the change I made I was able to determine that this matches:
>
> Hash: hEV8duHKvyjqcj2vdKXJ.O96
> Plain: UnsolvedMysterie
Well, it looks like someone created this one manually - maybe that
person was confused or wanted to make you hack the code.
> Would anyone be willing to share sample password files/hashes for
> these (and other) more rare formats?
You can find some sample hashes in SYNOPSIS sections for
Authen-Passphrase Perl modules:
http://search.cpan.org/~zefram/Authen-Passphrase/
Note that these often keep salts and hash encodings separate - you'd
need to concatenate them if so.
A bigcrypt sample is also seen on this posting:
http://www.openwall.com/lists/john-users/2005/08/23/3
(I was wrong in using the names bigcrypt and crypt16 interchangeably at
the time. The flavor that JtR does not support is actually the one that
should be called crypt16.)
Also relevant and includes a crypt16 sample:
http://marc.info/?l=bugtraq&m=92134851609589
BTW, I think it'd be a good idea to create a wiki page with sample
hashes under http://openwall.info/wiki/john - let's say, it could be
called sample-hashes.
> I guess the only way to handle this situation properly would be to
> have some flag to designate which type it is. Do you think it would
> be possible to detect one versus the other?
I don't think "hacked bigcrypt" hashes such as your UnsolvedMysterie
sample are worth supporting/detecting, unless there are actual systems
that use those. As it relates to bigcrypt vs. crypt16, this may be
detected in some special cases (then applied towards the rest of the
hashes, assuming that those are likely of the same type?), but in
general it would require a command-line option (a different "format")
or/and a hash type identifier to be added to the hash encodings.
> Perhaps it was something custom. No idea where this file came from.
This is no surprise.
Alexander
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
