Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 4 Nov 2016 16:46:14 +0100
Subject: Re: John does not fork as many times as I want


On 4 nov. 2016, at 16:13, matlink <> wrote:

>> Your guess is wrong.  "--restore" is more than that, and it is usually
>> much more efficient than starting over with the same parameters.
>> However, since you were getting forked processes not started or killed,
>> you did in fact have to start over not to miss any weak passwords.
> Alright. Is starting over meaning re-testing the whole potfile against
> the hashed pwd? The said potfile is about 670MB, then is not using
> --restore having a huge impact about performances? What if that file
> were much more huge, like 50GB?

Even if you don't use restore, a hash file will always be compared to your pot file, to get rid of already cracked hashes.
Using restore means you restart where you left. If you try a mask attack with ?d?d?d?d (0000 to 9999), halt at the middle (say 5555), using restore will restart the cracking session at ~5555.

As for the huge pot file, I've come to the conclusion that it can be better to keep not-too-huge pot file, and in some case to dedicate one pot file per hash type. But it's my personal experience…

You might want to use john --show=left > remaining-hash when you change attack modes (or masks, or wordlists…), the resulting file is smaller and pre-formatted so that it'll load way faster than original dump.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.