[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <554E497E.8020203@gmail.com>
Date: Sat, 09 May 2015 19:53:02 +0200
From: Marek Wrzosek <marek.wrzosek@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: bleeding-jumbo - How case and alpha options of regex mode suppose
to work?
W dniu 09.05.2015 o 19:34, Marek Wrzosek pisze:
> W dniu 08.05.2015 o 23:13, Marek Wrzosek pisze:
>> Hi
>>
>> How case and alpha options suppose to work?
>> In standalone regex mode command line:
>> ./john --regex=case="pass" --stdout
>> will print:
>> case=pass
>> To achieve what I wanted, I had to run something like this:
>> ./john --regex="(?i:pass)" --stdout
>> and output is:
>> pass
>> Pass
>> PAss
>> pAss
>> pASs
>> PASs
>> PaSs
>> paSs
>> paSS
>> PaSS
>> PASS
>> pASS
>> pAsS
>> PAsS
>> PasS
>> pasS
>>
>> As expected. But with wordlist or stdin mode these options work
>> differently, e.g.:
>> $ echo "pass"|./john --stdin --regex=case=alpha:case="\0" --stdout
>> buf=[pP][aA][sS][sS]
>> pass
>> Pass
>> pAss
>> PAss
>> paSs
>> PaSs
>> pASs
>> PASs
>> pasS
>> PasS
>> pAsS
>> PAsS
>> paSS
>> PaSS
>> pASS
>> PASS
>> 16p 0:00:00:00 0.00% 88.88p/s PASS
>>
>> but without =case option:
>> $ echo "pass"|./john --stdin --regex=alpha:case="\0" --stdout
>> buf=pass
>> pass
>> 1p 0:00:00:00 0.00% 4.166p/s pass
>>
>> the same is with:
>> $ echo "pass"|./john --stdin --regex=case="\0" --stdout
>> pass
>> 1p 0:00:00:00 0.00% 4.545p/s pass
>>
>> =alpha option for leet, leet2 and leet3 parameters is working as
>> expected, but need =case option to work with leet2_case and leet3_case
>> alphabets. With leet+c =alpha option does not need =case option. And of
>> course there is no leet_case alphabet in regex_alphabets.conf file.
>>
>> Maybe someone should revise README.librexgen file.
>> Undocumented - it's a bug, documented it'll be a feature ;-)
>>
>> Bests
>>
> There is another "trick" with librexgen enabled JtR. The combination of
> case and alpha options with something more than "\0" will cause this:
> $ echo "pass"|./john --stdin --regex=case=alpha:case="\0b" --stdout
> buf=[pP][aA][sS][sS]
> error: syntax error, unexpected $end, expecting T_END_CLASS
> Error, invalid regex expression. John exiting now base_word=pass
> Regex= [pP][aA][sS][sSb
>
> You need to add ] between \0 and your string.
> $ echo "pass"|./john --stdin --regex=case=alpha:case="\0]b" --stdout
> buf=[pP][aA][sS][sS]
> passb
> Passb
> pAssb
> PAssb
> paSsb
> PaSsb
> pASsb
> PASsb
> pasSb
> PasSb
> pAsSb
> PAsSb
> paSSb
> PaSSb
> pASSb
> PASSb
> 16p 0:00:00:00 0.00% 100.0p/s PASSb
>
> Strange thing is that "\0" and "\0]" are equivalents - there are no
> errors. The strangest things happen when you add something more
> complicated than simple string before \0:
> $ echo "pass"|./john --stdin --regex=case=alpha:case="(?i:r|d|t|f)\0"
> --stdout
> buf=[pP][aA][sS][sS]
> rpass
> Rpass
> dpass
> Dpass
> tpass
> Tpass
> fpass
> Fpass
> Pass
> dPass
> DPass
> tPass
> TPass
> fPass
> FPass
> pAss
> dpAss
> DpAss
> tpAss
> TpAss
> fpAss
> FpAss
> PAss
> dPAss
> DPAss
> tPAss
> TPAss
> fPAss
> FPAss
> paSs
> dpaSs
> DpaSs
> tpaSs
> TpaSs
> fpaSs
> FpaSs
> PaSs
> dPaSs
> DPaSs
> tPaSs
> TPaSs
> fPaSs
> FPaSs
> pASs
> dpASs
> DpASs
> tpASs
> TpASs
> fpASs
> FpASs
> PASs
> dPASs
> DPASs
> tPASs
> TPASs
> fPASs
> FPASs
> pasS
> dpasS
> DpasS
> tpasS
> TpasS
> fpasS
> FpasS
> PasS
> dPasS
> DPasS
> tPasS
> TPasS
> fPasS
> FPasS
> pAsS
> dpAsS
> DpAsS
> tpAsS
> TpAsS
> fpAsS
> FpAsS
> PAsS
> dPAsS
> DPAsS
> tPAsS
> TPAsS
> fPAsS
> FPAsS
> paSS
> dpaSS
> DpaSS
> tpaSS
> TpaSS
> fpaSS
> FpaSS
> PaSS
> dPaSS
> DPaSS
> tPaSS
> TPaSS
> fPaSS
> FPaSS
> pASS
> dpASS
> DpASS
> tpASS
> TpASS
> fpASS
> FpASS
> PASS
> dPASS
> DPASS
> tPASS
> TPASS
> fPASS
> FPASS
> 113p 0:00:00:00 0.00% 664.7p/s FPASS
>
> The first string (r in this example) is outputed only for the first
> combination of piped string, for every next combination the first string
> is empty.
>
The above is rexgen bug because:
$ rexgen [pP][aA][sS][sS]|rexgen -f - "(?i:r|d|t|f)\0"
rpass
Rpass
dpass
Dpass
tpass
Tpass
fpass
Fpass
Pass
dPass
DPass
tPass
TPass
fPass
FPass
pAss
dpAss
DpAss
tpAss
TpAss
fpAss
FpAss
PAss
dPAss
DPAss
tPAss
TPAss
fPAss
FPAss
paSs
dpaSs
DpaSs
tpaSs
TpaSs
fpaSs
FpaSs
PaSs
dPaSs
DPaSs
tPaSs
TPaSs
fPaSs
FPaSs
pASs
dpASs
DpASs
tpASs
TpASs
fpASs
FpASs
PASs
dPASs
DPASs
tPASs
TPASs
fPASs
FPASs
pasS
dpasS
DpasS
tpasS
TpasS
fpasS
FpasS
PasS
dPasS
DPasS
tPasS
TPasS
fPasS
FPasS
pAsS
dpAsS
DpAsS
tpAsS
TpAsS
fpAsS
FpAsS
PAsS
dPAsS
DPAsS
tPAsS
TPAsS
fPAsS
FPAsS
paSS
dpaSS
DpaSS
tpaSS
TpaSS
fpaSS
FpaSS
PaSS
dPaSS
DPaSS
tPaSS
TPaSS
fPaSS
FPaSS
pASS
dpASS
DpASS
tpASS
TpASS
fpASS
FpASS
PASS
dPASS
DPASS
tPASS
TPASS
fPASS
FPASS
--
Marek Wrzosek
marek.wrzosek@...il.com
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
