john-users - Display Cracked Hashes for a Specific Session

[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 16 Aug 2011 04:33:33 -0700 (PDT)
From: firstname lastname <psykosonik_frequenz@...oo.com>
To: john-users@...ts.openwall.com
Subject: Display Cracked Hashes for a Specific Session

I have a question regarding how to display cracked hashes for a specific session.

Let's say, I am cracking a hash file called hashes.txt.

I run 3 sessions against it with 3 different rules as follows:

./john -w:wordlist.txt --rules=rule1 --session=cracking1 hashes.txt
./john -w:wordlist.txt --rules=rule2 --session=cracking2 hashes.txt
./john -w:wordlist.txt --rules=rule3 --session=cracking3 hashes.txt

Now, when I use the -show option to display all the cracked hashes for hashes.txt file,

./john -show hashes.txt

it parses the JTR POT File for all the cracked instances and displays them.

What I want to know is, is it possible to display only the cracked hashes for a specific session?

./john -show --session=session1 hashes.txt

so that it displays, all the hashes cracked in that specific session using a specific rule.

This information is stored in the session log file according to me. Since, when I resume a cracking session,

./john --restore=session1

it shows the number of cracked hashes in that particular session.

For instance, you restore the session, press the space bar key to check the status. It displays, only the number of cracked hashes specific to this session and not all the cracked hashes of the file, hashes.txt

So, looks like this information is stored somewhere and there's a possibility to extract this information.

Regards,
NeonFlash