Date: Wed, 18 May 2011 14:44:07 -0400 (EDT) From: brad@...ystems.com To: john-users@...ts.openwall.com Cc: john-users@...ts.openwall.com Subject: Re: Help with 14 - 16 digit CC's stored in MD5 hash > Can anyone direct me to optimal configuration settings for JtR when attempting to reverse credit card information that is stored in MD5 hashes? The numbers are assumed to be 14-16 digits in length. > > Theory associated with what I would like to accomplish is can be found here. > http://www.integrigy.com/security-resources/whitepapers/Integrigy_Hashing_Credit_Card_Numbers_Unsafe_Practices.pdf > > The paper mentions several techniques as well as rainbow tables. I am looking for anyone that has actually generated tables specifically geared > toward this attack or for anyone that can offer configuration tips for JtR. Helping John make more efficient guesses would be the key, > implementing logic from the paper would be quite useful. > > Thanks > -KF A list of IINs (Issuer Identification Number) would cover the first six chars of the numbers. The remaining 10 or 8 digits, depending on the card type, would have to match-up with the IINs in such a way that the whole number (IIN + remaining digits) would be Luhn validateable. I do not believe that IINs are public data. The American Bankers Association is the keeper of the IIN list. Also, it may be illegal (not sure ask your lawyer before proceeding) to read or access a list of valid IINs without permission or some sort of merchant access/agreement in place. Talk to you lawyer now, it's very easy to get in trouble with credit card information and you don't want to do that. Just be certain what you are doing is legal before proceeding. Major Industry Identifiers (MIIs) (the first digit) are public information and would be a good starting point to narrow things down if your legal counsel advises you to not use IINs for this purpose, but still feel it is legal for you to try to reverse the CC hashes. Some trivia... 16 digit CCs are the most common, you'll get the most bang for your buck by focusing on that. 15 are more rare (Amex mostly in the U.S.) and 14 are too. Old Visa's used to be 13. Again, be very careful in what you are doing and be certain you don't break the law while doing so. Brad
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.