[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <00e401cd4451$5d121bc0$17365340$@net>
Date: Wed, 6 Jun 2012 21:00:49 -0500
From: "jfoug" <jfoug@....net>
To: <john-users@...ts.openwall.com>
Subject: RE: JtR to process the LinkedIn hash dump
>Another observation is that if you zero the first 20 bits of the
>complete hashes, you'll end up getting >63000 dupes. That is a little
>puzzling.
I believe this is because when loading the bin_hash is used, BUT JtR does a
full 40 byte memcmp to check the entire binary, not just the few bits the
hash does.
Thus when loading, Jtr will put both hashes into the same lookup 'table'.
When the password is found, the format ignores the first 32 bits, and thus,
both hashes (the full, and the overwritten with 0's) hashes get cracked
properly.
>The current format does not treat them as dupes when loading, but will
>crack and record both versions of the hash when finding a password.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
