[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <AANLkTikESfbQ4gqSNMcqhws4DnfHOcdmDTgnFS6o8zNt@mail.gmail.com>
Date: Tue, 19 Oct 2010 18:51:48 -0400
From: Rich Rumble <richrumble@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Solution to this 'l33t' rules problem?
On Tue, Oct 19, 2010 at 5:52 PM, Minga Minga <mingakore@...il.com> wrote:
> But how would you go about cracking the passwords:
>
> N3gl3cted n3gl3cted Negl3cted Negl3ct3d
>
> Notice that _NOT_ all of the e's are turned into 3s. I've started to see a few
> of these passwords that Ive missed previously, and I totally should have been
> able to crack them.
I suppose I need to test the l337 rules again, they would substitute all the e's
in my users passwords, and I wanted it to do all the combination's, to which
Solar responded: http://www.openwall.com/lists/john-users/2010/07/31/1
RememberMe was a pass I have encountered our helpdesk setting the passes
to, and users were just replacing some of the e's with 3's and not all.
I've created some additional rules along the lines of Solar's response for even
more letters and combination's of letters, to which I'm sure there are better
ways do it, I just look at the examples, get a cursory understanding of them
and rinse/repeat.
/e op3$
%2e op3 /e op[e3]
%3e op3 %2e op[e3] /e op[e3]
%4e op3 %3e op[e3] %2e op[e3] /e op[e3]
# Add 0-9 to those same rules
/e op3$[0-9]
%2e op3 /e op[e3]$[0-9]
%3e op3 %2e op[e3] /e op[e3]$[0-9]
%4e op3 %3e op[e3] %2e op[e3] /e op[e3]$[0-9]
/o op0
%2o op0 /o op[e0]
%3o op0 %2o op[e0] /o op[e0]
%4o op0 %3o op[e0] %2o op[e0] /o op[e0]
# Add 0-9 to those same rules
/o op0$[0-9]
%2o op0 /o op[e0]$[0-9]
%3o op0 %2o op[e0] /o op[e0]$[0-9]
%4o op0 %3o op[e0] %2o op[e0] /o op[e0]$[0-9]
I wonder if there is a better way to try 0-9 at the beginning and end of
these same words so they don't have to go through all the iterations again.
Sorry different topic... So to your question, I've seen the opposite using JtR's
default l337 rules, not your korelogic ones (not tested KL's ruleset). JtR's
being /ese3I typically look at the log file to see what JtR is converting rules
"into" and I use those, typically it removes spaces only.
- Rule #1378: '-c T1 Q M T0 Q' accepted as 'T1QMT0Q'
-rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
