[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANWtx00YWhOLevvC71gDELiPRDGEjddkTk5PUTJoYMGCQ1LV=A@mail.gmail.com>
Date: Wed, 2 Jan 2013 17:52:54 -0500
From: Rich Rumble <richrumble@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Multiple formats accepting the same raw hashes
> On Jan 2, 2013, at 1:53 PM, "Frank Dittrich" <frank_dittrich@...mail.com> wrote:
>> So, at the end of a long mail, finally a few questions:
>>
>> How important is it for you that john mentions which supported hash
>> algorithms might be used to crack a given set of hashes, instead of
>> silently using the first hash format which supported raw hashes of a
>> particular fixed length?
This is the behavior most people auditing windows LM passwords have
encountered for as long as I can remember when no format was given or
no hash type specified in the hash file. I think this should still be
the default behavior. LM now detects as 5 or 6 possible hashes types
currently.
Warning: detected hash type "lm", but the string is also recognized as "lotus5"
Use the "--format=lotus5" option to force loading these as that type instead
Warning: detected hash type "lm", but the string is also recognized as "mscash"
Use the "--format=mscash" option to force loading these as that type instead
Warning: detected hash type "lm", but the string is also recognized as "mscash2"
Use the "--format=mscash2" option to force loading these as that type instead
Warning: detected hash type "lm", but the string is also recognized as "raw-md4"
Use the "--format=raw-md4" option to force loading these as that type instead
Warning: detected hash type "lm", but the string is also recognized as "raw-md5"
Use the "--format=raw-md5" option to force loading these as that type instead
Warning: detected hash type "lm", but the string is also recognized as
"raw-md5u"
Use the "--format=raw-md5u" option to force loading these as that type instead
>> How important is it for you that the default hash format when starting a
>> new password crack session on the same input file remains the same even
>> across different john versions?
>> (The same question asked in another way: Would you like developers to
>> spend time on this "problem" instead of adding new hash formats,
>> improving performance of existing formats, fixing real bugs?)
I doubt it's an issue currently for most users, but perhaps one that
can have a warning when resuming that no format was specified
previously or that it is defaulting to format_x when resuming. And or
have such a warning and have the REC files from now on write in the
defaulted to format in the rec file. Use the defaulted format when
resuming along with the warning that the format could be one of these
others as well. That's my .02.
-rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
