[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240125143919.GA23043@openwall.com>
Date: Thu, 25 Jan 2024 15:39:19 +0100
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: DES passwords not cracked within hours
On Thu, Jan 25, 2024 at 06:57:46AM +0100, Matthias Apitz wrote:
> As I said, I used the same installation tree as in October 2022. At this
> time I could crack a password in ~20 minutes as the files proof:
>
> ~/guru/john-1.9.0-jumbo-1/run> ls -ltr --full-time john.pot /tmp/pins.des
> -rw-r--r-- 1 sisis sisis 104 2022-10-13 13:25:49.403363915 +0200 /tmp/pins.des
> -rw------- 1 sisis sisis 21 2022-10-13 13:44:58.261868507 +0200 john.pot
> ~/guru/john-1.9.0-jumbo-1/run> cat john.pot
> aAwfYXwckrtz6:010473
>
> The actual DES hash has the same length and the clear PIN only consists
> of 6 chars: one small letter, 4 digits and the #-symbol. And it's still
> running and after ~17 hours w/o any result.
Like you say, these two passwords are of different complexity (one is
all digits, the other not), and so they reasonably take different time
to crack (by the default invocation, which tries more common kinds of
passwords first). Since you know so much about the password, you can
indeed focus the attack. For example:
./john --length=6 passwd.des
or:
./john -9='a-z0-9#' -mask='?9' -length=6 passwd.des
or even:
./john -mask='?l?d?d?d?d#' passwd.des
The latter should complete instantly.
Separately, I recommend that you don't misuse /tmp.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
