john-users - Re: Is it possible to generate a candidate password based on a candidate password?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+E3k90rChQHuDSmE8NYgwt0JrQrHeP+0KVUxEqqLX_Zc=p45w@mail.gmail.com>
Date: Sat, 8 Oct 2016 05:26:26 -0800
From: Royce Williams <royce@...ho.org>
To: john-users@...ts.openwall.com
Subject: Re: Is it possible to generate a candidate password
 based on a candidate password?

On Sat, Oct 8, 2016 at 5:15 AM, magnum <john.magnum@...hmail.com> wrote:
> On 2016-10-07 21:40, Marek Wrzosek wrote:
>>
>> Hi
>>
>> W dniu 04.10.2016 o 19:31, Ailton Caetano pisze:
>>>
>>> I'm trying to generate a rule/set of rules that would allow me to
>>> generate
>>> passwordsbased in the following scheme:
>>>
>>> Passwords have
>>> - 5 lowercase chars
>>> - 2 uppercase chars
>>> - 1 digit
>>>
>> I'm not sure why do you need rules and wordlist for that, but you can
>> achieve that simply using mask mode alone or hybrid mask with incremental.
>>
>> Eg.
>> ./john --incremental=lower --mask=?w?u?u?d --min-length=8 --max-length=8
>>
>> or
>>
>> ./john --mask=?l?l?l?l?l?u?u?d
>
>
> I *think* Ailton meant the one digit can be located anywhere in the
> password, and so on. That would make mask mode pretty much unusable. Best
> bet might be the "policy" external mode but it only makes sense for pretty
> slow formats.

If Ailton meant that, then that's only 168 masks -- which seems
feasible to me, depending on the context.

Using policygen from the (unrelated to JtR) PACK toolkit:

$  ./policygen.py --minlower=5 --maxlower=5 --minupper=2 --maxupper=2
--mindigit=1 --maxdigit=1 --minlength=8 --maxlength=8
                       _
     PolicyGen 0.0.2  | |
      _ __   __ _  ___| | _
     | '_ \ / _` |/ __| |/ /
     | |_) | (_| | (__|   <
     | .__/ \__,_|\___|_|\_\
     | |
     |_| iphelix@...sprawl.org


[*] Using 1,000,000,000 keys/sec for calculations.
[*] Password policy:
    Pass Lengths: min:8 max:8
    Min strength: l:5 u:2 d:1 s:None
    Max strength: l:5 u:2 d:None s:None
[*] Generating [compliant] masks.
[*] Generating 8 character password masks.
[*] Total Masks:  65536 Time: 76 days, 18:50:04
[*] Policy Masks: 168 Time: 3:44:53


Use the --showmasks option to output all 168 masks.

Royce

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.