[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <dfedfb.2e5.13a16f73bf5.Webtop.0@cox.net>
Date: Sun, 30 Sep 2012 07:37:12 -0400 (EDT)
From: jfoug@....net
To: john-users@...ts.openwall.com
Subject: Re: WebEdition CMS
Simply looking at that format script, I believe it would work fine.
There is also ways a username can be used directly within dynamicc
instead. However, since anyone using this would be fabricating the JtR
input file, putting the username into a salt field would be just as easy
as putting into the username field when building the file.
Also, if a salt is used vs the username within dynamic, then there is a
nice optimization that can be used to double the speed of the format.
If you notice the base-16 MD5 of the salt (user name), is a static
string. This can be pre-computed at load time, and done only once. This
reduces the MD5 calls from 2 to 1 per password/salt trial. The format
instead becomes:
####################################################################
# DYNAMIC type for WebEdition CMS md5($p.md5($s))
####################################################################
[List.Generic:dynamic_1011]
Expression=md5($p.md5($s)) (WebEdition CMS)
Flag=MGF_SALTED
Flag=MGF_SALT_AS_HEX
Func=DynamicFunc__clean_input
Func=DynamicFunc__append_keys
Func=DynamicFunc__append_salt
Func=DynamicFunc__crypt_md5
Test=$dynamic_1011$e82bf09e8a1899d4c3d00a3f380d5cdb$SXB:openwall
On Sun, Sep 30, 2012 at 4:05 AM, Dhiru Kholia wrote:
> On Sun, Sep 30, 2012 at 12:37 PM, NeonFlash
> <psykosonik_frequenz@...oo.com> wrote:
>> I noticed that there is no implementation of a hashing algorithm used
>> in
>> WebEdition CMS yet. You can download the sourcecode from here:
>> The salted version will use the username as a salt. The algorithm
>> becomes:
>>
>> md5($p,md5($s))
>>
>> Currently in JtR, the closest match I was able to find for this
>> algorithm type is: dynamic_9
>>
>> ./john --subformat=LIST
>>
>> Format = dynamic_9 type = dynamic_9: md5($s.md5($p))
>>
>> However, the salt and usernames are reversed. Would it be possible to
>> implement it?
>
> Can you post some sample hashes along with passwords?
>
> Does the attached patch work against real hashes?
>
> Jim,
>
> Is the attached patch correct? (I don't understand dynamic format!).
>
> --
> Cheers,
> Dhiru
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
