Date: Tue, 14 Aug 2012 01:38:43 +0400 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: Salted MD5 cracking problems On Mon, Aug 13, 2012 at 07:45:32PM +0400, Vladimir Vorontsov wrote: > Salt length is fixed and can be 2 bytes (osCommerce) or 8 bytes > (Bitrix and some another). I'm never seen anothers lengths. But it is > possible in self-coded web-applications, not CMS. > Salt value is not fixed always. We have unique salt per hash. Well, like I said we can provide you with experimental code that will do roughly what you need (achieving speeds substantially higher than what you reported so far, but way below what your HD 6990 is capable of with more optimal code) for a manually specified salt (e.g., you'd need to put it in john.conf) - but then you'd need to be cracking these hashes one by one (or group them by salt with external scripts if some do share a salt value). We're not yet working on salted raw-MD5 code on GPU. (Our focus for the JtR/GPU work so far has been on slow hashes and non-hashes.) For now, I suggest that you run attacks more focused on likely passwords, maybe on CPU rather than on GPU. The difference between JtR's incremental mode and dumb exhaustive search may well compensate for the slowdown when going from GPU to CPU. (Apparently, new hashcat has something similar to incremental mode embedded in its mask mode, though - from what I read on their forums.) Ditto for good/large wordlists and rulesets. Of course, combining these smarter attacks with a higher speed would be better yet, but we just don't have that yet. Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.