Date: Wed, 20 Jun 2012 02:59:52 +0400 From: Solar Designer <solar@...nwall.com> To: john-dev@...ts.openwall.com Subject: Re: wbb3_fmt_plug.c is broken On Tue, Jun 19, 2012 at 07:54:55PM +0530, Dhiru Kholia wrote: > On 06/19/12 at 02:25am, Solar Designer wrote: > > wbb3_fmt_plug.c is broken in terms of supporting multiple hashes per > > salt. It only supports exactly one hash per salt. That is, if there > > are any matching salts, it will misbehave. > > I have tested the code with duplicate salts with no problems. Try > running john on attached file which contain duplicate salts (and > duplicate user names as well). OK, I've just tried that - yes, it works better than I had expected. The reason why is that it keeps hashes as part of "salts", so it does not detect matching salts unless the hashes match as well. This means that performance will be worse than it could otherwise be when there are in fact matching salts - the code will simply not take advantage of that. Also, the duplicate hash suppression is confused: $ ./john -w=w pw Loaded 4 password hashes with 3 different salts (WoltLab BB3 salted SHA-1 [32/64]) 123 (admin-testing) 123456 (admin-testing) password (admin-testing) password (user-password) guesses: 4 time: 0:00:00:00 DONE (Wed Jun 20 02:57:23 2012) c/s: 85.71 trying: password - 123 Use the "--show" option to display all of the cracked passwords reliably $ ./john --show pw admin-testing:123456 admin-testing:password admin-testing:123 3 password hashes cracked, 1 left $ ./john -w=w pw Loaded 4 password hashes with 3 different salts (WoltLab BB3 salted SHA-1 [32/64]) Remaining 1 password hash password (user-password) guesses: 1 time: 0:00:00:00 DONE (Wed Jun 20 02:57:34 2012) c/s: 18.75 trying: password - 123 Use the "--show" option to display all of the cracked passwords reliably As you can see, one of the cracked passwords was not written to john.pot the first time. > I am in process of fixing this and my other formats to follow JtR > conventions. Yes, please. Thanks, Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.