Date: Fri, 01 Feb 2013 14:58:53 -0600 From: jmk <jmk@...fus.net> To: john-dev@...ts.openwall.com Subject: Re: NTLMv1 and MSCHAPv2 (was: NetNTLMv1) On Fri, 2013-02-01 at 21:22 +0400, Solar Designer wrote: > I think the typical case is having only a relatively small number of C/R > pairs, though. If so, our changes speed things up a lot. Thanks for all the work on speeding this stuff up! I capture and crack C/R pairs during nearly every one of our assessments. That said, it's rare that I'm ever going after more than three or four of them at any given time. FWIW, the most common C/R that I'm seeing these days is NTLMv2, followed by LMv1+NTLMv1. In the LMv1+NTLMv1 case, I typically RainbowCrack the first portion of the password and then use John to get the rest. I'm not actually seeing all that many standalone NTLMv1 responses. Joe
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.