Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 9 Nov 2016 14:50:33 +0100
To: "" <>
Subject: alter default rules or filter, best way to focus on proper candidates?


I would like to use mangling rules with --wordlist or --loopback in a way they produce a reduced set of candidates, like "every candidates that are lowercase", "every candidates that have no digits", etc.

What would be the best way to use (jumbo's) wordlist rules that come with John but without any of them that creates candidates featuring upper case characters (or lower case, or digits…). I guess I could use a john process to create candidates then filter out those that don't match my criteria, but on fast hash I'm not sure it's interesting.
I'm currently trying to modify every single rule that can produce upper case characters, but it's a lost battle: so many different rules, so many possibilities, and in the end work has to be re-done when I want to get rid of candidates including digits or whatever other type of character.

I've made a few test with/without --external : 

$ time ./john --wordlist=spanish.dic --rules=jumbo --external=Filter_LowerNum --max-length=10 --stdout >/dev/null 
Press 'q' or Ctrl-C to abort, almost any other key for status
120562226p 0:00:02:13 100.00% (2016-11-09 14:20) 903828p/s zzuzoz

real	2m13.396s
user	2m13.266s
sys	0m0.055s

$ time ./john --wordlist=spanish.dic --rules=jumbo --max-length=10 --stdout >/dev/null 
Press 'q' or Ctrl-C to abort, almost any other key for status
221810292p 0:00:01:41 100.00% (2016-11-09 14:18) 2186Kp/s ZURRUMBERA

real	1m41.462s
user	1m41.349s
sys	0m0.079s

$ time ./john --wordlist=spanish.dic --rules=jumbo --stdout >/dev/null 
Press 'q' or Ctrl-C to abort, almost any other key for status
574580426p 0:00:02:13 100.00% (2016-11-09 14:27) 4293Kp/s zarrapastrosame

real	2m13.832s
user	2m13.345s
sys	0m0.417s

--external allows me to filter out about half the candidates, but total exec time is ~30% longer.
--max-length=10 costs me a lot too, with a number of candidates per second divided by 2

Eventually I'm considering this:

$ ./john --test --format=Raw-SHA1
Benchmarking: Raw-SHA1 [SHA1 128/128 AVX 4x]... DONE
Raw:	19915K c/s real, 19764K c/s virtual

If I understand correctly, "./john --wordlist=spanish.dic --rules=jumbo" will not create candidates as fast as it could consume them against Raw-SHA1. So I probably should not bother filtering or limit length, even if I know that without any filter 4 candidates out of 5 are a waste of CPU cycles.

Am I correct?


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.