[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20091028195850.GA22454@openwall.com>
Date: Wed, 28 Oct 2009 22:58:50 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Incremental check with specific rule
Joerg,
On Fri, Oct 23, 2009 at 04:12:29PM +0200, Joerg voelker wrote:
> I want to check passwords with the length of 8 or 9 chars. The passwords
> are all alpha-numeric. I know there is a password rule enforcing to use
> at least 1 upper, 1 lower and 1 numeric sign.
>
> How can I tell JtR only to test passwords meeting these requirements?
Please refer to this posting:
http://www.openwall.com/lists/john-users/2009/02/10/3
BTW, it is referenced from the wiki:
http://openwall.info/wiki/john/mailing-list-excerpts
with the following description:
On making "incremental" mode follow a password policy by an external
filter() (2009/02/10)
The approach will also work for cracking modes other than "incremental".
To go for lengths beyond 8 with "incremental" mode, if you really need
to, see this posting:
http://www.openwall.com/lists/john-users/2007/07/04/6
referenced from the wiki page as:
How to make "incremental" mode work for lengths beyond 8 (2007/07/04)
> The hashes I have are lotus5 hashes.
These are pretty fast to compute, so you could consider the overhead of
filter() vs. that of trying "impossible" candidate passwords. Maybe it
is more optimal to let JtR try "everything".
You mentioned that the passwords are all alpha-numeric, yet use both
upper and lower case. Unfortunately, of the supplied .chr files you
have to choose between all.chr, which includes all printable US-ASCII
(95 chars), and alnum.chr, which is lower case letters and digits only
(36 chars). One option is to use all.chr with a filter() as referenced
above. Another option is to generate a custom .chr file with just 62
chars (lower and upper case letters and digits), then decide on whether
you also want to apply a filter() to match your known password policy.
Of course, you may use other cracking modes as well. You may even use
the DumbForce external mode, which allows you to specify the charset
directly, although for lengthy passwords you should want something
smarter than it.
I hope this helps.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
