|
Message-ID: <CAJ9ii1F3XjQMeYRa7ypRusVKBdEn1C9YfeEn+s78zvy+n=MviQ@mail.gmail.com> Date: Wed, 28 Mar 2012 11:06:16 -0400 From: Matt Weir <cweir@...edu> To: john-users@...ts.openwall.com Subject: Re: Specific rule creation contest I've been participating in the contest on it so I figured I might as well share some of my observations: 1) It only involves 'unique' hashes from the phpbb list. So even though '123456' is a common password, cracking it only counts as 1 point. 2) If you're looking at winning, 'overtraining' is a good thing ;p 3) I just discovered last night that the same rules in JtR and Hashcat can produce different results due to optimizations in JtR. I had been building my rules in JtR since all my tools are set up for that, (here is a writeup from when I was optimizing JtR's single mode http://reusablesec.blogspot.com/2010/04/optimizing-john-rippers-single-mode-for.html), but when I used my rules on Hashcat I cracked significantly less passwords than I expected too. I need to look into this more since some of this could be a formatting error on my part when copying the rules over, but I did identify some of the differences like how JtR handles capitalization, (the 'c' rule). Aka if the first two letters are 'mc' JtR will capitalize the third letter, (for example 'McDonalds'). Hashcat always only capitalizes the first letter (Mcdonalds). I want to stress that JtR cracked more passwords so this certainly isn't a problem with JtR, but keep that in mind if you are competing in this contest. All that being said, I'm really glad I participated since I learned more about both JtR and Hashcat, and the challenge of optimizing a very limited cracking session by hand has been fun. It might be interesting to do a similar JtR focused contest in the future. Matt On Wed, Mar 28, 2012 at 4:52 AM, Simon Marechal <simon@...quise.net> wrote: > It is a bit late, but : > > http://beeeer.org/best64/ > > As hashcat and john rules are almost compatible, I suppose everybody > could try. Cleartexts can be found at : > > http://www.skullsecurity.org/wiki/index.php/Passwords > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. >
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.