john-users - Re: UniqPass versus JtR default password list and weird behavior

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 21 Jan 2013 09:29:47 -0500
From: Matt Gardenghi <mtgarden@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: UniqPass versus JtR default password list and weird behavior

Excellent. I'll try to learn to read better. ;-)

I'll give it another shot tonight.

Thanks.


On Mon, Jan 21, 2013 at 9:23 AM, Solar Designer <solar@...nwall.com> wrote:

> On Mon, Jan 21, 2013 at 09:11:39AM -0500, Rich Rumble wrote:
> > On Sun, Jan 20, 2013 at 10:44 PM, Matt Gardenghi <mtgarden@...il.com>
> wrote:
> > > c:\Users\Matt\Desktop\john179j5\run>john --wordlist=uniq.txt
> --format=nt
> > > ntlm.txt
> > > Loaded 8 password hashes with no different salts (NT MD4 [128/128 SSE2
> +
> > > 32/32])
> > This is specifying wordlist mode, once it's mangled the wordlist
> > specified using the default wordlist rules, it terminates as expected.
>
> When you specify --wordlist on the command line and do not also request
> --rules, no mangling occurs.  The wordlist is run without rules.
>
> > > I have repeated this process and verified the behaviors.  Any tips on
> what
> > > is going wrong?
>
> Nothing is going wrong.  John the Ripper does exactly what it is asked to.
>
> To obtain JtR's default behavior (the three different cracking modes),
> the wordlist should be specified in "Wordlist = ..." in the config file
> (john.ini on Windows), then "john" should be run (almost) without
> command-line option (--format=nt is needed in this case, though).
>
> Alternatively, the three modes (and maybe more) may be run explicitly,
> one by one.  "--wordlist=uniq.txt --rules=jumbo" is also a good thing to
> try (more mangling rules than are used by default).
>
> Alexander
>



-- 
Matt Gardenghi