Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 11 Jan 2013 10:48:20 -0700
From: Stephen John Smoogen <smooge@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Cracking md5 salted password

On 11 January 2013 00:00, fevere alleee <qweeak@...il.com> wrote:
> Hi,
>
> I'm newbie in this field. I got a md5 hash + salt in the format
> --
> user-name:$1$salt$hash
> ----
>
> I could get correct hash by "openssl passwd -1 -salt salt password" . Does
> this mean salt is in plain text ? How can i feed all this info into JTR so
> that i can get password for other users ( salt is 8 characters long ) ?

That is an md5crypt hash (or FreeBSD MD5 crypt hash, or FreeBSD crypt
depending on the literature). The Salt is in plain text and if the
password is less than 16 characters, then john will be able to brute
force it with

john --format=md5 --wordlist=<my dictionary goes here> <file with
passwords goes here>

If the passwords are longer than 15 characters then it needs the

john --format=crypt

which is usually 1/10th to 1/20th the speed of the shorter passwords.

Normally I do the following:

1) Run john with the top worst passwords lists (no more than 1000)

john --session=A --pot=projectA.pot --wordlist=password.lst passwd_file

2) Run john with the single rules. This takes the data stored in the
password file and figures out combinations that are most likely used

john --session=A --pot=projectA.pot --single password_file

3) Go with larger dictionaries and slower rules

john --session=A --pot=projectA.pot --rules
--wordlist=/usr/share/dict/words passwd_file

Look for patterns in the found passwords and try to figure out how to
"exploit" them. If you are auditing your companies passwords and the
companies name is RockPool.com then a lot of people are going to use
rock, pool, rockpool.com pool.com etc as the basis of their passwords
[rockpool1 will probably the number one password after password, and
account name.]

> Thanks
> qweeak



-- 
Stephen J Smoogen.
"Don't derail a useful feature for the 99% because you're not in it."
Linus Torvalds
"Years ago my mother used to say to me,... Elwood, you must be oh
so smart or oh so pleasant. Well, for years I was smart. I
recommend pleasant. You may quote me."  —James Stewart as Elwood P. Dowd

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.