[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAJ9ii1F3XjQMeYRa7ypRusVKBdEn1C9YfeEn+s78zvy+n=MviQ@mail.gmail.com>
Date: Wed, 28 Mar 2012 11:06:16 -0400
From: Matt Weir <cweir@...edu>
To: john-users@...ts.openwall.com
Subject: Re: Specific rule creation contest
I've been participating in the contest on it so I figured I might as
well share some of my observations:
1) It only involves 'unique' hashes from the phpbb list. So even
though '123456' is a common password, cracking it only counts as 1
point.
2) If you're looking at winning, 'overtraining' is a good thing ;p
3) I just discovered last night that the same rules in JtR and Hashcat
can produce different results due to optimizations in JtR. I had been
building my rules in JtR since all my tools are set up for that, (here
is a writeup from when I was optimizing JtR's single mode
http://reusablesec.blogspot.com/2010/04/optimizing-john-rippers-single-mode-for.html),
but when I used my rules on Hashcat I cracked significantly less
passwords than I expected too. I need to look into this more since
some of this could be a formatting error on my part when copying the
rules over, but I did identify some of the differences like how JtR
handles capitalization, (the 'c' rule). Aka if the first two letters
are 'mc' JtR will capitalize the third letter, (for example
'McDonalds'). Hashcat always only capitalizes the first letter
(Mcdonalds). I want to stress that JtR cracked more passwords so this
certainly isn't a problem with JtR, but keep that in mind if you are
competing in this contest.
All that being said, I'm really glad I participated since I learned
more about both JtR and Hashcat, and the challenge of optimizing a
very limited cracking session by hand has been fun. It might be
interesting to do a similar JtR focused contest in the future.
Matt
On Wed, Mar 28, 2012 at 4:52 AM, Simon Marechal <simon@...quise.net> wrote:
> It is a bit late, but :
>
> http://beeeer.org/best64/
>
> As hashcat and john rules are almost compatible, I suppose everybody
> could try. Cleartexts can be found at :
>
> http://www.skullsecurity.org/wiki/index.php/Passwords
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
