[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANWtx02Jpkw9_K=9BKJ7x9v4ovcWXdjTMCLR0rgUtvMf_peykw@mail.gmail.com>
Date: Mon, 19 Dec 2016 09:37:25 -0500
From: Rich Rumble <richrumble@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Bruteforce auto-generated md5crypt
On Mon, Dec 19, 2016 at 4:12 AM, Xender Cage <cybercooo@...il.com> wrote:
> Hi,
>
> I'm kind of having a headache trying to figure out how to put the john into
> bruteforce mode.
> I'm trying to recover the md5crypt password.
> It's used with generator and it generate all kind of printable char in the
> password.
>
> The problem is "How can I put the john to the bruteforce mode?" and not a
> hybrid mode.
> Because john start to crack with words and usually using sequence digits
> which is used to crack the human set password.
>
> For an example, it gave password like !4#25L but john crack with
> mdedne..mdedia which is obviously not in this case.
>
> Please help me.
> I spend nearly a week and it's still using "dytyr..dyte1" like password.
You HAVE to read the doc's. Incremental mode uses "smart-force" if you
will, guessing likely passwords. When trying to guess random or
unlikely passwords, you may want to try MASK mode or "dumb-force" (aka
brute-force) external mode. John can try keyboard patterns
(--external=keyboard) sequences (--external=sequence)
Dumb-force tries aa..az, aaa...zzz etc... mask mode can do the same
--mask=?a?a?a?a?a
https://github.com/magnumripper/JohnTheRipper/blob/bleeding-jumbo/doc/MASK
Depending on how the password generator works, it's random may not be
*that* random, or it may have a weakness in some other manner. John
has external modes that attack a few password generators:
--external=strip (Secure Tool for Recalling Important Passwords)
--external=DokuWiki
--external=KDEPaste
--external=AwesomePasswordGenerator
There may be more, look in john.conf to see... All of those have some
flaw that the external mode is trying to exploit. If you can find
something similar in the generator used for the passwords your
attacking, you might make short work of them. Otherwise I think MASK
will be where you want to start. Passwords over 10-12 characters in
length that are "random" won't be worth your effort on a single
machine, unless your running a GPU rig.
-rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
