[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 6 Feb 2013 23:01:09 -0500
From: <jfoug@....net>
To: john-dev@...ts.openwall.com
Subject: New tool (comments wanted). pcap2john
On an offlist conversation, Magnum made a wishlist comment. I would like to post this idea here, so that others can also comment. I think this is really a nice idea. Probably not a trivial project, but a nice idea. It may be something that starts off smaller (such as the wpapsk2john), but then it grows over time, sort of like how pass_gen.pl has grown over time originally from a few 1 liner perl hacks on a jtr wiki page.
Here was the post from magnum:
<quote>
what we need next is a pcap2john that doesn't miss a beat. Speaking of that: We should have a generic pcap2john that finds *any* JtR supported format in a pcap file, and output hashes accordingly. So for one single pcap file, you could end up with DMD5 hashes, wpapsk hashes, ntlmv1, krb5 and so on. That would be mighty cool for pentests. It should be written so it's easy to add new formats. I haven't sniffed wlan for years though - isn't that one level lower? So perhaps you couldn't really find wpapsk handshakes and pop3 authentications in the same file. Or maybe nowadays you can? </quote>
One thing that would be nice for a tool like this, is initially a list of what hashes can be found in this way, and what packet(s) are needed to produce the hash, what data on these packets are needed to make the input hash.
Jim.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
