Date: Thu, 28 Jun 2012 03:18:41 +0200 From: magnum <john.magnum@...hmail.com> To: john-dev@...ts.openwall.com Subject: Re: --regen-lost-salts (was: 'New' functionality added to JTR (finding salted passwords, without salts)) On 2012-04-20 01:13, Frank Dittrich wrote: > On 04/20/2012 12:34 AM, jfoug wrote: >> Well, the 2 formats I have been working on are: PHPS/dynamic_6, which is >> md5(md5($p).$s) with 3 byte salt, and osCommerce (dynamic_4), md5($s.$p) >> with a 2 byte salt. Both of these formats have salt values from a space >> char, up to 0x7e (the '~' tilde char). From some initial testing, I found a >> lot of the PHPS (I have about 800k of them), and also there are a lot of >> OSCommerce (I am just starting to collect them). > > That's interesting. But under normal circumstances, you probably > wouldn't throw away the salt. (Or are there systems which compute the > hash with a rendom salt, but don't store the salt? The one who dumped the hashes might have missed that database column just out of cluelessness. Or for some reason you could not get the salts during a pen-test. > After cracking several passwords, did you detect any patterns, i.e., > non-random salts? > Either a non-uniform distribution of salts, or a salt which (due to a > broken implementation) based on the password? I saw non-uniform distribution for sure. I never got to test this curious feature until now, when testing that last BSS patch. It's pretty cool and faster than I thought. I ran password.lst on the first 10 million lines in the KoreLogic md5 file, like this (btw -wo now defaults to password.lst): $ head -10000000 test/hashes/raw-md5.hashes.txt > regen-test.md5 $ ./john regen-test.md5 -fo:osc --regen-lost-salts=2 -wo -nolog ... guesses: 14369 time: 0:00:00:21 DONE (2012-06-28 03:16:28) c/s: 13573G trying: princesa - hallo magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.