Date: Wed, 28 Oct 2009 22:58:50 +0300 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: Incremental check with specific rule Joerg, On Fri, Oct 23, 2009 at 04:12:29PM +0200, Joerg voelker wrote: > I want to check passwords with the length of 8 or 9 chars. The passwords > are all alpha-numeric. I know there is a password rule enforcing to use > at least 1 upper, 1 lower and 1 numeric sign. > > How can I tell JtR only to test passwords meeting these requirements? Please refer to this posting: http://www.openwall.com/lists/john-users/2009/02/10/3 BTW, it is referenced from the wiki: http://openwall.info/wiki/john/mailing-list-excerpts with the following description: On making "incremental" mode follow a password policy by an external filter() (2009/02/10) The approach will also work for cracking modes other than "incremental". To go for lengths beyond 8 with "incremental" mode, if you really need to, see this posting: http://www.openwall.com/lists/john-users/2007/07/04/6 referenced from the wiki page as: How to make "incremental" mode work for lengths beyond 8 (2007/07/04) > The hashes I have are lotus5 hashes. These are pretty fast to compute, so you could consider the overhead of filter() vs. that of trying "impossible" candidate passwords. Maybe it is more optimal to let JtR try "everything". You mentioned that the passwords are all alpha-numeric, yet use both upper and lower case. Unfortunately, of the supplied .chr files you have to choose between all.chr, which includes all printable US-ASCII (95 chars), and alnum.chr, which is lower case letters and digits only (36 chars). One option is to use all.chr with a filter() as referenced above. Another option is to generate a custom .chr file with just 62 chars (lower and upper case letters and digits), then decide on whether you also want to apply a filter() to match your known password policy. Of course, you may use other cracking modes as well. You may even use the DumbForce external mode, which allows you to specify the charset directly, although for lengthy passwords you should want something smarter than it. I hope this helps. Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.