Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sun, 11 Nov 2007 07:29:17 +0300
From: Solar Designer <>
Subject: Re: cracking a 12 charactor password

On Fri, Nov 09, 2007 at 01:53:58PM +0000, wrote:
> As part of a system audit, I am being asked to audit application admin password. I know it is 12 characters and MD5.

"MD5" as in "FreeBSD-style MD5-based crypt(3)"?  If so, you're out of
luck cracking that password, unless it is totally trivial (e.g., a
dictionary word).

> I am trying to use John (win32mmx 1.7 multi-patch) with option -i.

You're out of luck cracking an MD5-based crypt(3) password that is 12
characters long with "incremental" mode, even if there were no compile
time length limitation for that mode.

> I have changed the MaxLen to 12. When I run john -i passwordfile (one user's password) I get a message MaxLen = 12 exceeds the compile time limit of 8.

Indeed, but that's not the primary reason why that would not work well.

> Can john's options be set to try and crack a MD5 password larger then 8 characters? 

Yes.  There are cracking modes other than "incremental".  Those do
not have the compile-time length limitation and they actually have a
chance of cracking your long password.  Use the "single crack" mode,
then a wordlist with word mangling rules (or two wordlists: first a
tiny one, then a larger one), then maybe try the "keyboard" external
mode (it's included in the default john.conf).

For wordlist mode, you can limit John to trying 12-character long
candidate passwords only by defining and using an external filter().
Since the c/s rate for MD5-based crypt(3) hashes is quite low anyway,
the overhead of filter() won't be too large.

Better yet, you may pre-process your wordlist as follows:

	john --wordlist=all.lst --rules --stdout=12 | egrep '^.{12}$' | unique mangled.lst

Then use it in the simplest way possible:

	john --wordlist=mangled.lst mypasswd

Of course, you could also use an external filter() here instead of the

For the "keyboard" mode, you can adjust the minlength and maxlength
values in that mode's init() (in your john.conf).

Once again, the above recommendations assume that you're cracking a
relatively slow hash.  For very fast hashes, they could be different.

Alexander Peslyak <solar at>
GPG key ID: 5B341F15  fp: B3FB 63F4 D7A3 BCCC 6F6E  FC55 A2FC 027C 5B34 1F15 - bringing security into open computing environments

Was I helpful?  Please give your feedback here:

To unsubscribe, e-mail and reply
to the automated confirmation request that will be sent to you.

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.