Date: Sun, 5 Aug 2012 17:44:45 +0530 From: Dhiru Kholia <dhiru.kholia@...il.com> To: john-users@...ts.openwall.com Subject: Re: OS X keychain single empty/spaces result, but guessing continues? On Sun, Aug 5, 2012 at 5:41 AM, Royce Williams <royce@...ho.org> wrote: > I'm working on a Mac OS X keychain recovery. The target file was > generated with keychain2john from an unaltered login.keychain. > > $ john -i=all keychain.txt > Loaded 1 password hash (Mac OS X Keychain PBKDF2-HMAC-SHA-1 3DES [32/64]) > > ... but shortly afterwards, the following appears (preceded by 17 spaces): > > (login.keychain) > Was the actual password different from what john printed? Can you feed your actual password to john and see if john cracks login.keychain successfully or not? Currently, the Keychain format is FMT_NOT_EXACT which means that we can't be 100% sure that the recovered password was the actual password. Hence, john continues to run after the initial guess. -- Cheers, Dhiru
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.