Date: Thu, 28 Aug 2008 04:46:13 +0400 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: generating a wordlist with john On Wed, Aug 27, 2008 at 08:27:39PM -0400, Adam Turk wrote: > The reason this came up is I was reading a posting at forums.remote-exploit.org that says I could use john to generate a wordlist. Indeed, you can. > To find the size of a wordlist it is number of characters ^ to the length you want. This depends on what kind of a wordlist you want. If you want all possible combinations of characters in fixed-length strings, then that is correct. > If I understand this correctly, using john --incremental=All --stdout=2 will just randomly generate a combination of characters and then truncate said combination to the length specified. There is no guarantee that you would end up with every possible combination of 95 characters. The generated list could have the same word multiple times and leave some out. Is this right? No. doc/FAQ has this entry: Q: Are the strings tried with "-i" ("incremental" mode) random? They certainly look like they are almost random. A: No, they are not. No single candidate password will be tried for a second time and the order in which they are tried is in fact very smart: it is based on frequencies of different trigraphs, stored and processed separately for each character position and for each password length. It is in fact guaranteed that every possible combination will be generated, and it is guaranteed that no combination will appear more than once. You were doing everything right, except that you were confused by the absence of a minimum length constraint. I've already explained how you can introduce one if you like (with "MinLen", with filter(), or with an external program), although you probably don't need to (it is fine and usually even desirable to test the shorter candidate passwords as well). Alexander -- To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.