[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120329113002.GA25965@openwall.com>
Date: Thu, 29 Mar 2012 15:30:02 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Simple John Rules Example
On Wed, Mar 28, 2012 at 04:01:07PM -0500, jmk wrote:
> I just started playing with John rules and I'm thoroughly confused. I'm
> attempting to simply try different combinations of vowel removal. For
> example, if my dictionary contains "bonkers", I'd like to test bonkers,
> bnkers, bonkrs, and bnkrs. I can purge all vowels with "@?v", but that
> isn't what I'm looking for. I can remove the first vowel with "/?v Dp
> Q", but that isn't right either.
You can use something like this:
%4?v Dp %3?v D[p*] %2?v D[p*] /?v D[p*]
%3?v Dp %2?v D[p*] /?v D[p*]
%2?v Dp /?v D[p*]
/?v Dp
This example works for words with up to 4 vowels (you can easily expand
it to work for up to 5, etc.) Unfortunately, it is somewhat inefficient:
many of the rules produced after preprocessor expansion will happen to
reject many of the input words. The rules are currently such that each
rule can produce at most one candidate password from one input word, so
in order to have multiple candidate passwords per input word we have to
use multiple rules (or have them generated with the preprocessor like
in the example above - those square brackets do it).
> Any pointers? Is the RULES file the best place to start for learning
> these things?
The existing rulesets in john.conf, especially the one for "single
crack" mode, are also good for learning - but you have to check the
RULES file to understand the rules found in john.conf.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
