john-users - Password Hashes loaded vs. ./john --show

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Wed, 3 May 2006 16:19:39 -0400
From: "Arvind Sood" <asood74@...il.com>
To: john-users@...ts.openwall.com
Subject: Password Hashes loaded vs. ./john --show

Hello,

I am not sure what the significance of the following is (if any at all !)

When I loaded a Windows 2000 pwdump3e output file into JTR, here is the
message I got

[root@...alhost run]# ./john --format=NT  pwoutput.txt
Loaded 14 password hashes with no different salts (NT MD4 [TridgeMD4])

Here is the output for  ./john  --show after some time

[root@...alhost run]# ./john --show pwoutput.txt
Guest:NO PASSWORD:501:NO PASSWORD*********************:::
__vmware_user__:NO PASSWORD:1029:6C4E0294BE699CBD47773135069425CD:::

2 password hashes cracked, 43 left

Notice the difference in number of password hashes (14 vs. 43+2). What
explains this difference?

As always - I have read the archives prior to mailing, but apologise if this
has been dealt with before.

Kind regards
Arvind