[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 28 Aug 2008 14:34:19 -0400
From: Adam Turk <bofh1234@...mail.com>
To: <john-users@...ts.openwall.com>
Subject: RE: generating a wordlist with john
> Date: Thu, 28 Aug 2008 04:46:13 +0400
> From: solar@...nwall.com
> To: john-users@...ts.openwall.com
> Subject: Re: [john-users] generating a wordlist with john
>
> On Wed, Aug 27, 2008 at 08:27:39PM -0400, Adam Turk wrote:
> > The reason this came up is I was reading a posting at forums.remote-exploit.org that says I could use john to generate a wordlist.
>
> Indeed, you can.
>
> > To find the size of a wordlist it is number of characters ^ to the length you want.
>
> This depends on what kind of a wordlist you want. If you want all
> possible combinations of characters in fixed-length strings, then that
> is correct.
>
> > If I understand this correctly, using john --incremental=All --stdout=2 will just randomly generate a combination of characters and then truncate said combination to the length specified. There is no guarantee that you would end up with every possible combination of 95 characters. The generated list could have the same word multiple times and leave some out. Is this right?
>
> No. doc/FAQ has this entry:
>
> Q: Are the strings tried with "-i" ("incremental" mode) random? They
> certainly look like they are almost random.
> A: No, they are not. No single candidate password will be tried for a
> second time and the order in which they are tried is in fact very smart:
> it is based on frequencies of different trigraphs, stored and processed
> separately for each character position and for each password length.
>
> It is in fact guaranteed that every possible combination will be
> generated, and it is guaranteed that no combination will appear more
> than once.
>
> You were doing everything right, except that you were confused by the
> absence of a minimum length constraint. I've already explained how you
> can introduce one if you like (with "MinLen", with filter(), or with an
> external program), although you probably don't need to (it is fine and
> usually even desirable to test the shorter candidate passwords as well).
Let me start with saying I am not a programmer. Why do you need a minimum length constraint?
Thanks,
_________________________________________________________________
See what people are saying about Windows Live. Check out featured posts.
http://www.windowslive.com/connect?ocid=TXT_TAGLM_WL_connect2_082008
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
