Date: Mon, 21 Sep 2015 17:07:51 +0300 From: Solar Designer <solar@...nwall.com> To: john-dev@...ts.openwall.com Subject: Re: Judy array On Mon, Sep 21, 2015 at 06:18:34AM -0700, Fred Wang wrote: > Here go (you know you can run mdxfind too - I won't be offended :-) > > https://www.sendspace.com/file/v04opu Preliminary analysis: There are no hashes that JtR cracked and MDXfind did not. There are 947 hashes that MDXfind cracked and JtR did not. The corresponding passwords are of at least 7 characters long (none are shorter than 7). No other obvious pattern yet. I've tested a couple against john --stdout for the same wordlist and rules, and they are not in there, so at least for these two it's some discrepancy in the candidates stream rather than in the hashing or comparisons. One such password is noimage. A similar line in the wordlist is geoimagen, although there are several other (not so) similar ones. A rotate rule might be producing noimage on MDXfind, but somehow not on JtR. For 133156 cracked hashes MDXfind reports passwords different than JtR does. Out of those, 110206 appear to be truncated and 22950 appear to use $HEX unnecessarily (and are in fact misreported if we interpret those embedded NULs and what follows as part of passwords, which they actually are not). The corresponding passwords reported by JtR look correct. I only tested maybe 10 of them, though. Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.