[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAJ9ii1FaG=3D-pU-Cok6j5oKaHbtqk2M3xYVV+ZeXyRWHz29KQ@mail.gmail.com>
Date: Tue, 8 Oct 2013 12:54:52 -0400
From: Matt Weir <cweir@...edu>
To: "john-users@...ts.openwall.com" <john-users@...ts.openwall.com>
Subject: Re: How best to compute this via john
There seems to be a couple of sub-topics when it comes to passphrase
cracking
1) Dictionary Generation: How do you collect / create / clean input
dictionaries of phrases
2) "Brute Force" strategies: How do you generate phrases that might be used
in a passphrase
- A "dumb force" approach would be a diceware approach where you start
picking random words
- A "Markov" approach could select words based on their conditional
probability
3) Figuring out mangling rules to use
I do have a couple of wish lists for JtR when it comes to passphrase
cracking
a) Hashcat has a "Title/E" rule where it will lowercase a phrase and then
capitalize every word after a space. That would be nice
b) I'd like to be able to perform multi-letter replacements. For example
'one' -> '1'
c) I'd like to be able to use multiple dictionaries in JtR and refer to
them directly in a mangling rule. Aka have all rules by default start with
an implicit "insert word from dictionary 1", but have the ability to change
that around and say "insert word from dictionary 2" "append word from
dictionary 3" "append '123'". That way we could start doing things like
"ProperName" + "loves" + "ProperName". It may be best to do this with an
outside script though. In short though it would be nice to have a more
advanced version of Hashcat's combinator attacks.
Right now I pretty much deal with all of those by using an outside script
an pipeing it into JtR.
Matt
On Tue, Oct 8, 2013 at 12:11 PM, Stephen John Smoogen <smooge@...il.com>wrote:
>
> http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/2/
>
> I am guessing that some scripts would be needed to parse through a large
> library of project Gutenberg and Wikipedia articles and then output
> something like:
>
> Sentence as it is
> Sentence lowercased
> Sentence no punctuation/lowercased
> First 2 words of sentence
> First 3 words of sentence
> ....
>
> I am guessing we are running out of time in the universe at this point. I
> would try to speed it up by taking all the sentences (break up anything in
> quotes as a separate sentence.) and then sort them by order of frequency.
> That way "To be or not to be" would be higher than "The genus spectrum of
> the common toad spans a far distance."
>
> Lord this is going to be a load of work :).
>
> --
> Stephen J Smoogen.
>
>
>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
