Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 01 Feb 2013 14:58:53 -0600
From: jmk <>
Subject: Re: NTLMv1 and MSCHAPv2 (was: NetNTLMv1)

On Fri, 2013-02-01 at 21:22 +0400, Solar Designer wrote:
> I think the typical case is having only a relatively small number of C/R
> pairs, though.  If so, our changes speed things up a lot.

Thanks for all the work on speeding this stuff up!

I capture and crack C/R pairs during nearly every one of our
assessments. That said, it's rare that I'm ever going after more than
three or four of them at any given time. 

FWIW, the most common C/R that I'm seeing these days is NTLMv2, followed
by LMv1+NTLMv1. In the LMv1+NTLMv1 case, I typically RainbowCrack the
first portion of the password and then use John to get the rest. I'm not
actually seeing all that many standalone NTLMv1 responses.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.