john-users - Re: l33t rules improvement

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 16 Apr 2013 10:37:23 +0100
From: JJ Gray <jj.gray@....qinetiq-tim.com>
To: john-users@...ts.openwall.com
Subject: Re: l33t rules improvement

Have a look at the KoreLogic JtR rules from DEFCON2010 [1], amongst many
sections that are based on how people actually choose passwords
(particularly in a corporate environment), are extended "l33t" blocks.

Cheers,
		JJ

[1] http://contest-2010.korelogic.com/rules.html

On 16/04/2013 10:02, Guth wrote:
> Hi,
> 
> While playing with wordlist, I realized that the default l33t rules in
> john.conf are missing "frequent" patterns, mostly:
> 
> i -> 1
> t -> 7
> 
> others (lower priority):
> s -> 5
> b -> 8
> g -> 9
> 
> Here is my dirty/incomplete patch (for i->1 only), I'm not used to rules
> reading/writing, so please advise/correct (add t->7, ... ?)
> It's not extensively tested, so it should probably improved:
> 
> -[:c] l /[aeilos] s\0\p[43110$] (?\p1[za] \p1[:c]
> -[:c] l /a /[eilos] sa4 s\0\p[3110$] (?\p1[za] \p1[:c]
> -[:c] l /e /[ilos] se3 s\0\p[110$] (?\p1[za] \p1[:c]
> -[:c] l /i /[los] se1 s\0\p[10$] (?\p1[za] \p1[:c]
> -[:c] l /l /[os] sl1 s\0\p[0$] (?\p1[za] \p1[:c]
> -[:c] l /o /s so0 ss$ (?\p1[za] \p1[:c]
> -[:c] l /a /e /[ilos] sa4 se3 s\0\p[110$] (?\p1[za] \p1[:c]
> -[:c] l /a /e /[los] sa4 se3 s\0\p[10$] (?\p1[za] \p1[:c]
> -[:c] l /a /i /[los] sa4 sl1 s\0\p[0$] (?\p1[za] \p1[:c]
> -[:c] l /a /l /[os] sa4 sl1 s\0\p[0$] (?\p1[za] \p1[:c]
> -[:c] l /a /o /s sa4 so0 ss$ (?\p1[za] \p1[:c]
> -[:c] l /e /i /[los] se3 sl1 s\0\p[0$] (?\p1[za] \p1[:c]
> -[:c] l /e /l /[os] se3 sl1 s\0\p[0$] (?\p1[za] \p1[:c]
> -[:c] l /[eil] /o /s s\0\p[311] so0 ss$ (?\p1[za] \p1[:c]
> -[:c] l /a /e /i /[los] sa4 se3 sl1 s\0\p[0$] (?\p1[za] \p1[:c]
> -[:c] l /a /e /l /[os] sa4 se3 sl1 s\0\p[0$] (?\p1[za] \p1[:c]
> -[:c] l /a /[eil] /o /s sa4 s\0\p[311] so0 ss$ (?\p1[za] \p1[:c]
> -[:c] l /e /i /l /o /s se3 sl1 so0 ss$ (?\p1[za] \p1[:c]
> -[:c] l /e /l /o /s se3 sl1 so0 ss$ (?\p1[za] \p1[:c]
> -[:c] l /a /e /i /l /o /s sa4 se3 sl1 so0 ss$ (?\p1[za] \p1[:c]
> 
> Regards.
>