[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 5 Dec 2011 07:31:55 -0600
From: "JimF" <jfoug@....net>
To: <john-users@...ts.openwall.com>
Subject: Re: cracking RADIUS shared secrets with john the ripper
>>> (I believe the answer is the latter, but wanted
>>> to check with others). Should I restrict the output to one line per
>>> original password ?
>>
>> John will handle all of this. If 10 hashes use garbage password of 123456, then each of them should show up cracked in john.pot, all with the same password.
>
>Yes, and if I have different users with the same password, it makes
>sense; but what I was thinking is if I have different (salt, hash)
>couples for the same "user" (in my RADIUS case, users are client
>machines), hence the same password; it will uselessly slow down the
>cracking process to store them all in the password file.
If you have 100's of hashes from an individual machine, and you KNOW the pw has not changed, i.e. you know that all are from the exact same password, then you should dump all but one. In an audit like this where you are in somewhat control of knowledge, that is probably a very wise idea. A single hash is all that is needed, and all that should be used. However, if you know there is a 7 day, or 14 day policy on password changes, and are auditing many machines, then all bets are off, since it will likely be that machines or users are not on the 'same' change day schedule, thus there is little information on which salt/hash have the same passwords.
Interesting task.
H.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
