Date: Sun, 15 Feb 2009 17:34:34 +0300 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: Broken long/double DES hash split On Sun, Feb 15, 2009 at 01:04:46AM -0600, Joshua J. Drake wrote: > With the change I made I was able to determine that this matches: > > Hash: hEV8duHKvyjqcj2vdKXJ.O96 > Plain: UnsolvedMysterie Well, it looks like someone created this one manually - maybe that person was confused or wanted to make you hack the code. > Would anyone be willing to share sample password files/hashes for > these (and other) more rare formats? You can find some sample hashes in SYNOPSIS sections for Authen-Passphrase Perl modules: http://search.cpan.org/~zefram/Authen-Passphrase/ Note that these often keep salts and hash encodings separate - you'd need to concatenate them if so. A bigcrypt sample is also seen on this posting: http://www.openwall.com/lists/john-users/2005/08/23/3 (I was wrong in using the names bigcrypt and crypt16 interchangeably at the time. The flavor that JtR does not support is actually the one that should be called crypt16.) Also relevant and includes a crypt16 sample: http://marc.info/?l=bugtraq&m=92134851609589 BTW, I think it'd be a good idea to create a wiki page with sample hashes under http://openwall.info/wiki/john - let's say, it could be called sample-hashes. > I guess the only way to handle this situation properly would be to > have some flag to designate which type it is. Do you think it would > be possible to detect one versus the other? I don't think "hacked bigcrypt" hashes such as your UnsolvedMysterie sample are worth supporting/detecting, unless there are actual systems that use those. As it relates to bigcrypt vs. crypt16, this may be detected in some special cases (then applied towards the rest of the hashes, assuming that those are likely of the same type?), but in general it would require a command-line option (a different "format") or/and a hash type identifier to be added to the hash encodings. > Perhaps it was something custom. No idea where this file came from. This is no surprise. Alexander -- To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Powered by Openwall GNU/*/Linux - Powered by OpenVZ