[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <706e2029-638c-e967-926d-e44afb591165@sqplus.net>
Date: Sun, 22 Nov 2020 17:38:21 +0900
From: SQP Admin <admin@...lus.net>
To: john-users@...ts.openwall.com, Solar Designer <solar@...nwall.com>,
john.magnum@...hmail.com
Subject: Re: Session management on AMI - Interrupting and
resuming
Hi Alexander, Magnum,
Thank you for the prompt and insightful feedback.
> The way incremental mode works, limiting the character set to Alnum (62
> different characters) provides only a slight reduction in cracking time
> (if the password fits this character set) than the default (letting JtR
> use all 95 printable characters, but aware that most of those are rather
> uncommon and are only commonly seen in certain combinations). So you
> need to be very confident the password fits this character set in order
> to reasonably limit the attack like that.
We were actually assuming that our password would not have special
characters and thus that proceeding with an Alnum incremental attack at
first would be much faster and potentially save us money, should our
assumption be true. We understand now that the time benefit is only
minimal, thank you very much for these insights.
> 2. Use one of the tools "screen" or "tmux", both of which are readily
> available in the AMI. You'd use them before you start the original
> session, or before you restore it, so that you wouldn't have to do the
> interrupt and restore thing again, but would simply re-attach to the
> running session.
We have followed your advice and are using screen. It is pretty
straightforward. Thank you for the recommendation.
> Most importantly, are you running this instance as spot? You really
> should be, and maybe c5.24xlarge will fit your budget then, without
> having to interrupt it?
We switched to a spot c5.18xlarge instance following your advice, the
costs are much lower which will allow us to run our attack for a longer
time and stay within the budget. Thanks a ton for the recommendation.
> Actually, for WinZip you'd have better speed and performance/dollar on a
> GPU in p3.2xlarge. So I assume/hope you have a PKZIP archive, for which
> "--fork=96" on c5.24xlarge is appropriate.
The file we are working on is a PKZIP archive. Therefore we are taking
the CPU approach as we saw recommended while browsing the documentation.
We are running a regular incremental attack, "--fork=72" on a
c5.18xlarge, thanks to your previous advice. The passwords tried per
second difference with a c5.24xlarge seems minimum, so we went with the
less expensive of the two.
Thank you again for you support.
Best,
Mike
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
