Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 23 Mar 2011 01:35:11 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: single mode

On Tue, Mar 22, 2011 at 08:25:16PM +0100, magnum wrote:
> I did that fprintf hack so I can answer most of this myself.

I'm sorry I was not quick enough.  Thank you for posting the answers!

> * All words from the GECOS field that starts with a letter and consists 
> of alphanumeric only (anything else is scrapped)

Not exactly.  loader.c uses these separator characters:

/*
 * Word separator characters for ldr_split_words(), used on GECOS fields.
 */
#define issep \
	"!\"#$%&'()*+,-./:;<=>?@...]^_`{|}~\177"

And then there's this check in single.c:

		c = (unsigned int)first->data[0] | 0x20;
		if (c < 'a' || c > 'z') continue;

> [...] all possible pairs of these words (concatenated with no 
> delimiter) are tried. Also, another similar set of pairs is tried with 
> *first* word truncated to one character.

It is worth noting that the "first" word here is actually any word with
number below SINGLE_WORDS_PAIR_MAX (which is 4).  That is, by default
the first 3 words from the GECOS field will be additionally tested in
their truncated form (as initials).

>   jdoe      <- truncated pairs
>   djohn

Right, that's what I meant above.

> However, only the first four words are allowed as the first half of a 
> pair. If there are five words, the fifth will only ever be the second 
> half of a pair.

Not exactly.  The fifth (and on) won't be "paired" at all.  Here's what
happens (excluding combinations with the username, home directory name,
and initials):

w1
w1w2
w1w3
w1w4
w2
w2w1
w2w3
w2w4
w3
w3w1
w3w2
w3w4
w4
w5
w6

As you can see, w5 and w6 were not part of any pair.

> This is to limit the number of combinations and this 
> limit can be changed by altering SINGLE_WORDS_PAIR_MAX in params.h and 
> recompiling.

Exactly.

> >Would I ever need to swap 1 and 2 in  rules? I mean, if I have this rule:
> >
> >-p 1 $@ 2
> >
> >is there any reason to also have:
> >
> >-p 2 $@ 1
> >
> >or will that be tried anyway?
> 
> It will be tried anyway

Yes, except for the special case mentioned below.

> unless one of the words is word #5 or higher on the input line.

Yes, but in that case "-p 1 $@ 2" won't be trying the combination as well.

The special case, with default settings, is with word #4, which is never
tried as the first word in a pair (it's only tried as the second).

> There may be a little more to this that I haven't noticed but this is 
> the gist of it.

Right.  Thanks again!

Alexander

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ