[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <AANLkTikoWFTUnrT7bY5VXoexWi75hY4P=Kd40=8b8719@mail.gmail.com>
Date: Mon, 22 Nov 2010 09:37:45 -0500
From: Charles Weir <cweir@...edu>
To: john-users@...ts.openwall.com
Subject: Re: Microsoft SQL passwords
Hey Rich,
Thanks, that was a really good read. I don't have my copy of
John in front of me, but I know it supports mssql hashes, and I assume
that it incorporates the attack vs. the uppercased half of the hash
since that attack type has been known since 2002. Even if it didn't,
it would be fairly easy to run that attack manually simply by copying
the salt and the second half of the hash and then using Solar's salted
SHA1 attacks that were incorporated in the newest Jumbo patch. You
would just have to remember to use only uppercase characters in your
cracking attack. I'm also fairly certain that the SHA1 hashing
algorithm used in John is faster than the default hashing algorithm
used in wincrypt.h which is what the program in the writeup uses.
Thanks once again. I had never looked into how mssql worked before and
that writeup provided a good description.
Matt
On Sun, Nov 21, 2010 at 8:13 PM, Rich Rumble <richrumble@...il.com> wrote:
> http://www.exploit-db.com/download_pdf/15537 Not sure if it's a faster
> way of cracking M$ SQL passwords or not, claims to be faster, thought
> I'd pass it on in case.
> -rich
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
