[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150729184553.GA8847@openwall.com>
Date: Wed, 29 Jul 2015 21:45:53 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Why does john display some cracked passwords twice?
On Wed, Jul 29, 2015 at 10:20:02AM +0200, Marek Wrzosek wrote:
> For now, I stuck, so I'll probably go back in time (remove some lines
> from pot file) and calmly I'll try to reproduce the problem.
> Most likely this is because of wordlist/loopback with rules and fork, an
> unfortunate coincidence that two or more threads are using two or more
> different but similar words and different rules that together cause the
> same output in the exact same moment that "pot sync" was unable to deal
> with them. That is a lot of coincidence for me ;-)
> It should happens from time to time. Isn't it too frequent then?
This might well be too frequent, or not, depending on your exact
circumstances. You had mentioned you saw this problem even with modes
such as incremental and prince - if so, that's a bug, so please try to
reproduce it and let us know if you were able to or not. And we'd like
to be able to reproduce the problem, too, so a testcase would be very
helpful, if you can provide that.
> I can easily remove duplicates by using uniq command, no harm done.
You don't need to remove them. John's output during cracking is just
for you to be aware of its progress, and john.pot is normally for John's
internal use. The actual cracking results you should obtain with "john
--show passwordfileshere", and this won't show any duplicates even if
there are duplicate lines in your pot file.
> BTW, I was using fork with wordlist+rules mainly because of this statement:
> "Warning: no OpenMP support for this hash type, consider --fork=4".
Sure, your use of --fork is fine.
> Maybe it should be disabled for certain cases like above.
Why, I guess it completed much quicker with --fork than it would have
without, even if it produced some duplicate cracks.
> Most probably it's EOT. Thanks for help, magnum.
I would be happier to end this thread when we have a specific
conclusion: a JtR bug (e.g., if reproducible with modes other than
wordlist and loopback) or just an expected side-effect of having similar
input words (e.g., what you saw is not surprising at all if that was in
loopback mode, where you could have the same passwords already in your
john.pot, e.g. for different salts). Thank you, Marek.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
