[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20201020152531.GA18482@openwall.com>
Date: Tue, 20 Oct 2020 17:25:31 +0200
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: GUI-based attack configuration
On Thu, Sep 03, 2020 at 09:54:33PM +0200, Solar Designer wrote:
> Here's a project I hadn't heard of and personally have no use for, but
> someone might find useful or relevant as a UI example:
>
> https://github.com/sc0tfree/mentalist
>
> "Mentalist is a graphical tool for custom wordlist generation. It
> utilizes common human paradigms for constructing passwords and can
> output the full wordlist as well as rules compatible with Hashcat and
> John the Ripper."
>
> This reminded me of the following thoughts I had earlier:
>
> Maybe we should enhance Johnny with optional GUI-based construction of
> wordlist rules.
Today, Elcomsoft blogged about having added similar functionality to
Elcomsoft Distributed Password Recovery:
https://blog.elcomsoft.com/2020/10/ruling-out-the-encryption/
"[...] EDPR's brand new, fully visual Rules editor. The same familiar
John the Ripper syntax can be now used easily, in WYSIWYG ("What You See
Is What You Get") manner. Just enter the test core word (e.g.
"password") and start adding the rules. You'll see immediately not only
how the generated potential passwords will look like, but the number of
such passwords per dictionary entry which is extremely important when
estimating the time it takes for the attack to complete."
> Additionally, now that we support many end-user password recovery use
> cases, it's desirable to have some UI (a web page or GUI app?)
> comfortable for a typical user to specify whatever they recall about the
> password. It should actively inquire the user about that, as (from my
> experience) people may be at a loss on what kind of information to
> provide despite of actually having the information. This should result
> in automatic selection of cracking mode(s) to use and configuration of
> those. Ideally, it should also inform the user of the resulting
> keyspace and expected attack duration (maybe given a pre-specified speed
> that the user can edit).
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
