[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <554E452E.6010902@gmail.com>
Date: Sat, 09 May 2015 19:34:38 +0200
From: Marek Wrzosek <marek.wrzosek@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: bleeding-jumbo - How case and alpha options of regex mode suppose
to work?
W dniu 08.05.2015 o 23:13, Marek Wrzosek pisze:
> Hi
>
> How case and alpha options suppose to work?
> In standalone regex mode command line:
> ./john --regex=case="pass" --stdout
> will print:
> case=pass
> To achieve what I wanted, I had to run something like this:
> ./john --regex="(?i:pass)" --stdout
> and output is:
> pass
> Pass
> PAss
> pAss
> pASs
> PASs
> PaSs
> paSs
> paSS
> PaSS
> PASS
> pASS
> pAsS
> PAsS
> PasS
> pasS
>
> As expected. But with wordlist or stdin mode these options work
> differently, e.g.:
> $ echo "pass"|./john --stdin --regex=case=alpha:case="\0" --stdout
> buf=[pP][aA][sS][sS]
> pass
> Pass
> pAss
> PAss
> paSs
> PaSs
> pASs
> PASs
> pasS
> PasS
> pAsS
> PAsS
> paSS
> PaSS
> pASS
> PASS
> 16p 0:00:00:00 0.00% 88.88p/s PASS
>
> but without =case option:
> $ echo "pass"|./john --stdin --regex=alpha:case="\0" --stdout
> buf=pass
> pass
> 1p 0:00:00:00 0.00% 4.166p/s pass
>
> the same is with:
> $ echo "pass"|./john --stdin --regex=case="\0" --stdout
> pass
> 1p 0:00:00:00 0.00% 4.545p/s pass
>
> =alpha option for leet, leet2 and leet3 parameters is working as
> expected, but need =case option to work with leet2_case and leet3_case
> alphabets. With leet+c =alpha option does not need =case option. And of
> course there is no leet_case alphabet in regex_alphabets.conf file.
>
> Maybe someone should revise README.librexgen file.
> Undocumented - it's a bug, documented it'll be a feature ;-)
>
> Bests
>
There is another "trick" with librexgen enabled JtR. The combination of
case and alpha options with something more than "\0" will cause this:
$ echo "pass"|./john --stdin --regex=case=alpha:case="\0b" --stdout
buf=[pP][aA][sS][sS]
error: syntax error, unexpected $end, expecting T_END_CLASS
Error, invalid regex expression. John exiting now base_word=pass
Regex= [pP][aA][sS][sSb
You need to add ] between \0 and your string.
$ echo "pass"|./john --stdin --regex=case=alpha:case="\0]b" --stdout
buf=[pP][aA][sS][sS]
passb
Passb
pAssb
PAssb
paSsb
PaSsb
pASsb
PASsb
pasSb
PasSb
pAsSb
PAsSb
paSSb
PaSSb
pASSb
PASSb
16p 0:00:00:00 0.00% 100.0p/s PASSb
Strange thing is that "\0" and "\0]" are equivalents - there are no
errors. The strangest things happen when you add something more
complicated than simple string before \0:
$ echo "pass"|./john --stdin --regex=case=alpha:case="(?i:r|d|t|f)\0"
--stdout
buf=[pP][aA][sS][sS]
rpass
Rpass
dpass
Dpass
tpass
Tpass
fpass
Fpass
Pass
dPass
DPass
tPass
TPass
fPass
FPass
pAss
dpAss
DpAss
tpAss
TpAss
fpAss
FpAss
PAss
dPAss
DPAss
tPAss
TPAss
fPAss
FPAss
paSs
dpaSs
DpaSs
tpaSs
TpaSs
fpaSs
FpaSs
PaSs
dPaSs
DPaSs
tPaSs
TPaSs
fPaSs
FPaSs
pASs
dpASs
DpASs
tpASs
TpASs
fpASs
FpASs
PASs
dPASs
DPASs
tPASs
TPASs
fPASs
FPASs
pasS
dpasS
DpasS
tpasS
TpasS
fpasS
FpasS
PasS
dPasS
DPasS
tPasS
TPasS
fPasS
FPasS
pAsS
dpAsS
DpAsS
tpAsS
TpAsS
fpAsS
FpAsS
PAsS
dPAsS
DPAsS
tPAsS
TPAsS
fPAsS
FPAsS
paSS
dpaSS
DpaSS
tpaSS
TpaSS
fpaSS
FpaSS
PaSS
dPaSS
DPaSS
tPaSS
TPaSS
fPaSS
FPaSS
pASS
dpASS
DpASS
tpASS
TpASS
fpASS
FpASS
PASS
dPASS
DPASS
tPASS
TPASS
fPASS
FPASS
113p 0:00:00:00 0.00% 664.7p/s FPASS
The first string (r in this example) is outputed only for the first
combination of piped string, for every next combination the first string
is empty.
--
Marek Wrzosek
marek.wrzosek@...il.com
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
