Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANWtx00-C2B6_Swq9AdPpW6j4vLTBeg0-w0Onu+yL6QjZ3Hveg@mail.gmail.com>
Date: Sat, 1 Aug 2015 17:36:23 -0400
From: Rich Rumble <richrumble@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Why does john display some cracked passwords twice?

On Sat, Aug 1, 2015 at 5:28 PM, Rich Rumble <richrumble@...il.com> wrote:
> On Sat, Aug 1, 2015 at 4:34 PM, Luis Rocha <luiscrocha@...il.com> wrote:
>> Hello,
>>
>> I am not sure if it is related but I am seeing the same behavior. Please
>> see below:
>>
>> user@...kstation:~/JohnTheRipper/run$ ./john
>> /home/data/hashes/2013cmiyc/2013cmiyc_dist/Company1/pro-hashes.8.txt
>> --fork=4 --wordlist=/home/data/wordlists/bestwordlist/allwords.txt
>> --rules:Single --format=descrypt
>> Using default input encoding: UTF-8
>> Loaded 1793 password hashes with 1471 different salts (descrypt,
>> traditional crypt(3) [DES 256/256 AVX2-16])
>> Node numbers 1-4 of 4 (fork)
>> Each node loaded 1/4 of wordfile to memory (about 661 KB/node)
>> Press 'q' or Ctrl-C to abort, almost any other key for status
>> acetabul         (?)
>> acetabul         (?)
>> acetabul         (?)
> When fork was first introduced as very alpha just before a certain
> CMIYC, the same issue occurred I thought. Then it was fixed, in
> addition to the duplicates there was an issue with not every fork
> writing to the pot, but they would display stdout. I believe there was
> a john.conf setting to log them until it was fixed... I don't recall
> and I don't have those threads from contest. I wish I could find those
> conversations... I'm going to try to reproduce with my binaries btw.
I was unable to reproduce with a very recent version of jumbo, the
passwords loaded are salted in the example above, so unless those
hashes and salts are the same in the POT. Look in the POT to see if
they are actually duplicates. You can see "repeats" on stdout with any
hash, if john.pot is storing duplicates, then that is a problem. Again
using --show or during cracking it's not unexpected to see duplicates,
it is unexpected to see them in the POT.
-rich

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.