Date: Tue, 20 Apr 2010 20:52:38 -0400 From: "Matt Weir" <cweir@...edu> To: <john-users@...ts.openwall.com> Subject: Plaintext Length Limited Password Hashes I've been doing some work with John's new Single mode rules, (they were redesigned in patch 1.7.4), and noticed two rules that were not producing any guesses: # Some [birth] years... l Az"19[7-96-0]" <+ >- l Az"20" <+ >- At first I thought it might be a typo, aka I would expect that they should instead be written as: l Az"19[7-96-0]" <+ l Az"20" <+ This way it will create guesses such as 'pass197'. Otherwise they would only create a guess if the guess length equaled the maximum length allowed for a password hash. After scratching my head for a bit, I realized that they were for when a user's password was truncated. A good example of that is with Lanman hashes. I have two questions then: 1) What other password hashes have a short, (less than 20), maximum length for the plaintext password. I know the original crypt(3) DES hash had a shorter length, but how often does that still pop up? This falls into general curiosity. 2) Would it be useful to include those three digit combos still for other password hashes, (where the user didn't have their password truncated)? Matt Weir
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.