Date: Mon, 9 Jan 2006 06:18:24 +0300 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: cracking application (non-OS) passwords (was: Query on John the Ripper tool) On Fri, Jan 06, 2006 at 04:51:52PM +0530, V, Bharath (Bharath) wrote: > We are planning to use John the ripper tool to crack the passwords of our > Solaris machines. Apart from that we are also planning to use this tool for > cracking our application passwords. > Can this tool be used for cracking any applications apart from OS logins. This was not the intent of the officially released versions of John the Ripper, however the really short answer to your question is - "yes, in some cases". In particular: 1. If an application re-uses the same password hashing method that an operating system supported by John uses, then you can use John to crack password hashes produced by that application. The most common scenario would be a Unix application using the crypt(3) function to hash its users' passwords. You only need to generate an /etc/passwd-like file with the usernames (or any identifiers) and the corresponding password hashes, separating these two fields with a colon, one user:hash pair per line. Then you can feed the file to John as usual. 2. A number of other password hashing methods, including those specific to some applications, are supported with the contributed patches. You can find a list of the patches on the John the Ripper homepage: http://www.openwall.com/john/ To use these, you need to apply the appropriate patch(es) to the source code of John, compile it, and then run it on a passwd-like file with your application's password hashes. For example, many "web applications" (website "engines", forums, etc. typically written in PHP) misuse raw MD5 for hashing registered users' passwords. There is a contributed patch to support these hashes. -- Alexander Peslyak <solar at openwall.com> GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598 http://www.openwall.com - bringing security into open computing environments Was I helpful? Please give your feedback here: http://rate.affero.net/solar
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.