[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAKsR=11rAWZx+HanmWPS5Vc=5UHMGC+qoQhEdDPrzWmv7V+H0g@mail.gmail.com>
Date: Sun, 20 Jan 2013 22:44:44 -0500
From: Matt Gardenghi <mtgarden@...il.com>
To: john-users@...ts.openwall.com
Subject: UniqPass versus JtR default password list and weird behavior
I put together a quick list of passwords (ntlm) based on a short sample of
bad passwords:
47394fdd5150187c465228f0994e8485
cee791ecc8644e94d5e650da7fe93c4f
36cea0e644818081b18b0760ade25165
35d08b53d075ad3e7a042ee28eff1b00
fa8e1a3e8ac0a32b61ad5126f41752b3
1557fe8d82c72256fa5fdca8ca12461c
259745cb123a52aa2e693aaacca2db52
4e92f66afa557023e033a56ed61a0301
Those hashes include
12345678
Natalie1
dribgib
mfmitm
....
So, I ran >john --format==nt ntlm.txt
That immediately popped three passwords and then an 2 minutes later hit a
fourth.
I deleted the .pot file. I acquired the uniqpass list and tried to
substitute that list. Its a 1.2GB dictionary list. John pulled two
passwords and then ended saying it was done in one minute.
c:\Users\Matt\Desktop\john179j5\run>john --wordlist=uniq.txt --format=nt
ntlm.txt
Loaded 8 password hashes with no different salts (NT MD4 [128/128 SSE2 +
32/32])
12345678 (?)
dribgib (?)
guesses: 2 time: 0:00:01:09 DONE (Sun Jan 20 22:28:07 2013) c/s: 12383K
trying:
~~~~~~87 - ~~~~~~~~~~~~~~~~~~~~
Use the "--show" option to display all of the cracked passwords reliably
I would have assumed that john would have started performing brute force
attacks before terminating. This makes me think something went wrong.
I have repeated this process and verified the behaviors. Any tips on what
is going wrong?
--
Matt Gardenghi
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
