Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 8 Mar 2010 10:16:19 -0600
From: Minga Minga <>
Subject: Re: john.conf provided with JTR by default

> No, I do not readily have a better ruleset, and creating one is not one
> of my priorities.  Other people have been working on this lately - some
> have posted their results in here (thanks!)  None of this looked like
> something I would want to include into the default john.conf, though.


I will be presenting at numerous conferences this year on this exact topic.
i.e. creating john the ripper rules based on real password analysis of complex
passwords. I have essentially created multiple large rules that match patterns
that are chosen by users in corporate environments. These users are required
to meet certain password complexity rules - but still choose poor passwords
based upon recognizable patterns.

I will be sharing all my data/rules/wordlists once all the conferences are done.
This will be around August 2nd (End of Defcon in Vegas).

Even my rules, which are based on about 2.9 million cracked passwords
are not 'clean/precise' enough to be included in the default john the ripper
ruleset. But they will be easily usable using --rules:insert_rule_here


Also: Does anyone hang out in IRC all day?
There is a #john channel on freenode:
-ChanServ- [#john] This channel devoted to discussion of JTR aka John the Ripper

Im just sitting there if anyone wants to talk password crackin'


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.