[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <039801cae0ec$f20f19a0$d62d4ce0$@edu>
Date: Tue, 20 Apr 2010 20:52:38 -0400
From: "Matt Weir" <cweir@...edu>
To: <john-users@...ts.openwall.com>
Subject: Plaintext Length Limited Password Hashes
I've been doing some work with John's new Single mode rules, (they were
redesigned in patch 1.7.4), and noticed two rules that were not producing
any guesses:
# Some [birth] years...
l Az"19[7-96-0]" <+ >-
l Az"20[01]" <+ >-
At first I thought it might be a typo, aka I would expect that they should
instead be written as:
l Az"19[7-96-0]" <+
l Az"20[01]" <+
This way it will create guesses such as 'pass197'. Otherwise they would only
create a guess if the guess length equaled the maximum length allowed for a
password hash. After scratching my head for a bit, I realized that they were
for when a user's password was truncated. A good example of that is with
Lanman hashes.
I have two questions then:
1) What other password hashes have a short, (less than 20), maximum length
for the plaintext password. I know the original crypt(3) DES hash had a
shorter length, but how often does that still pop up? This falls into
general curiosity.
2) Would it be useful to include those three digit combos still for other
password hashes, (where the user didn't have their password truncated)?
Matt Weir
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
