john-users - Re: JTR against 135 millions MD5 hashes

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 12 Apr 2012 20:04:50 +0200
From: "websiteaccess@...il.com" <websiteaccess@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: JTR against 135 millions MD5 hashes

On Thu, 12 Apr 2012 21:54:27 +0400, Solar Designer wrote:
> On Thu, Apr 12, 2012 at 07:40:20PM +0200, websiteaccess@...il.com wrote:
>>  I'm trying my own text dictionary (6 gigas) against 135 millions (4,6 gigas) hash file.
> 
> Is this part of KoreLogic's torrent with lots of hashes?  (I haven't
> looked at it yet.)
> 
>>  After 20 minutes, JTR begin to crack MD5, but it very very slow, in fact JTR seems frozen, I can hear the hard drive running and running.
> 
> How much RAM do you have?
> 
> How much does the "john" process occupy?
> 
> What version of JtR is that?
> 
>>  JTR display also -> "excessive partial hash collisions detected"
> 
> Thanks for the info.  We'll need to check whether this is supposed to
> happen with that number of hashes or not.
> 
>>  If I try the same process with only 200 megas hashes files (4.6 splitted in 200 megas parts), this time JTR crack tons of MD5 after 2 or 3 
>> minutes.
>> 
>>  Is JTR able to crack 1 file with 135 millions MD5 hashes ?
> 
> It should be, but you may need more RAM.  Alternatively, try the
> --save-memory=2 option or/and split the file into a few chunks (e.g.,
> maybe halves of that large file will fit in your RAM one at a time).
> 
> Alexander


Thanks for your replies,

> How much RAM do you have? 4 gigas
> How much does the "john" process occupy? between 90% to 100%
> What version of JtR is that? latest 1.7.9 jumbo 5
> My OS -> Mac Intel OS X LION 10.7


 Your can download all hashes at :
https://www.korelogic.com/InfoSecSouthwest2012_Ripe_Hashes.html

 Md5, SHA1 and others formats.

 W/A/