john-users - Re: Couple of questions regarding rules (preprocessor) and truncation

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 19 Mar 2011 22:25:30 +0100
From: magnum <guzziraz@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Couple of questions regarding rules (preprocessor)
 and truncation

On 2011-03-19 00:17, Frank Dittrich wrote:
> Try this instead:
>
> '-M>[2-9A-Z]'\p[2-9A-Z]QAz"1234"
> or just
> '-M'[2-9A-Z]QAz"1234"
>

Yes, but even if I managed to discard all duplicates even for unsorted 
wordlists, I would still not want the preprocessor to create hundreds of 
thousands of rules that just will have *all* of its candidates 
discarded. That is hundreds of thousands of times shuffling the whole 
wordlist (which may be tens or hundreds of megabytes) from disk through 
code and then straight to the bit bucket. My point is to not *produce* 
so many candidates that is later rejected!

For example, the last rule you wrote above would take 0:35 instad of 
1:31, used with the Rockyou wordlist against 135 hashes/one salt of DES. 
(Naturally, I tested that by changing the range to [2-7]). That is some 
decent performance boost! Now replace "1234" with "[0-9][0-9][0-9][0-9]" 
and do the math.

For now, the solution is to have different sets of rules (length ranges) 
for different formats. If we could use the length constants in the 
preprocessor, this would be done automatically.

I'm afraid there's more to it though. If the constants would just be 
"translated" to the corresponding digit or letter (might be an easy 
hack), the [0-*] would work for LM and DES but not MD5 (that would mean 
[0-F] which includes invalid characters). But if it was written [0-9A-*] 
it would not work for LM and DES (translates to eg. [0-9A-8], invalid).

So maybe [0-*] must be a special case just for this.

magnum