Date: Sun, 22 May 2005 22:16:46 +0200 From: "Frank Dittrich" <frank_dittrich@...mail.com> To: john-users@...ts.openwall.com Subject: Feature request regarding --rules option Hi, I think it could be a useful feature if the --rules option would accept an optional qualifier: --rules[=RULESET] If not specified, the default rule set should be Wordlist when the --rules option is used together with --wordlist[=FILE] or --stdin. It should be Single, if used together with option --single (independent on whether or not --rules is specified together with the --single option). Or, just don't allow different rule sets for single mode. I think it's more helpful for word lists. With this addition, you don't need to edit john.conf, if you want to apply a different set of rules. Instead, you could maintain different rule sets and decide which rule set to try in which sequence, for which word list(s), or for which passwd file or --salts option. Reasons to have different rule sets: It does make sense to try more rules on small word lists (e.g. names) or with --salts=20 first, check which rules cracked most passwords, and apply these rules to larger word lists or for the other salts. For passwords cracked using the incremental mode, you could check whether it makes sense to define new rules to crack other passwords which might have been built using the same mangling rule. For systems with different password policies, you could adjust the sequence of rules accordingly. E.g., if the users are required to change their password every month, you'll frequently find password "schemes" like secret01, secret02, ... If you know the password has to be mixed case and contain at least one special character, you can use this knowledge to adjust the sequence of rules... Another reason might be the recently discussed LANMAN and NT hash issue. One workaround is to use different directories and adjust the [List.Rules:Wordlist] section of john.conf accordingly. But then you'd have to synchronize the john.pot files. The other workaround is to edit the john.conf file and rename a section to [List.Rules:Wordlist] after renaming the old [List.Rules:Wordlist] section. But this is error prone if you have several instances of john running at the same time. If you have to restart your machine, you have to make sure to restore the [List.Rules:Wordlist] section correctly before you can resume cracking, otherwise the corresponding .rec file is toast. Keeping Wordlist and Single as the defaults will ensure you can still use your old .rec files after upgrading JtR to a newer version. What do you think? Is this addition useful? It should be fairly easy to implement. Regards Frank Dittrich
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.