john-users - Re: Different results with multiple salts in a file

Openwall wordlists collection for password cracking (20+ languages)

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 7 Apr 2011 07:22:16 +0200
From: Frank Dittrich <frank_dittrich@...mail.com>
To: john-users@...ts.openwall.com
Subject: Re: Different results with multiple salts in a file

Hi Zach,

I couldn't reproduce the issue, even after fixing the admin line
(removing the space after the colon.)

Here is john's output:

Loaded 3 password hashes with 2 different salts (MS-SQL05 [ms-sql05])
titi             (titi)
toto             (toto)
guesses: 2  time: 0:00:00:00 100.00% (ETA: Thu Apr  7 07:10:02 2011) 
c/s: 82.35  trying: toto

May be it would have been better to include
john's output as well.

So I can only guess what went wrong:

1.
Your larger file contained salts for different hash types,
you didn't specify --format=mssql05 on the command line.
That's why john started cracking only hashes with the
same hash type as the first valid hash in your file.
And this wasn't mssql05.

In this case, you should see the hash type that's actually used
being mentioned in the first line of john's output.

You can force a specific hash type with --format, e.g. --format=mssql05.

(I guess the next release will improve output in cases john is started
with files containing hashes of different hash types.)

2.
The hashes have already been cracked and stored in the pot file.
In this case, use ./john --show <your_filename> to see the cracked hashes

3.
There yould be a bug in the mssql05 code which is part of the jumbo patch.
In this case, a reproducible example would be good.

Best regards,

Frank