[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <e69c08311a3fdf3e23f0e40fe449d5b7@smtp.hushmail.com>
Date: Sat, 20 Apr 2013 01:31:58 +0200
From: magnum <john.magnum@...hmail.com>
To: john-users@...ts.openwall.com
Subject: Re: Fuzzing with regular expressions
The suggestion I mentioned is not on this list but in your "issues":
http://code.google.com/p/rexgen/issues/detail?id=5
magnum
On 19 Apr, 2013, at 22:55 , Jan Starke <jan.starke@...ofbed.org> wrote:
> Hi
>
> yeah, there should be a simple way of creating a C (without ++) interface.
>
> Unfortunately, I have some problems reading full email threads. I must work
> on this. If I understand you right, you want to combine another wordlist
> generator with rexgen, e.g. to extend simple wordlists, like this:
>
> cat wordlist.txt | rexgen 're1<pipeinput>re2' | ...
>
> I still had a similar idea, because we sometimes could need something like
> this. I still have some work to do on the current features, but this will
> be the next feature.
>
> Kind regards, jan
>
>
> 2013/4/16 magnum <john.magnum@...hmail.com>
>
>> On 16 Apr, 2013, at 22:17 , Jan Starke <jan.starke@...ofbed.org> wrote:
>>> I just changed some things and was able to speed up rexgen by the
>>> factor of 5 (on my system) without using threads; additionally the
>>> ordering of the values is partly random. Maybe you want to give it a
>>> try...
>>
>> I am delighted to report that under OSX (built with gcc/g++) r44 is 11.5
>> times faster than the last version I tried (which was r24 or so). Previous
>> speed about 2.3MB/s (405K words/s) and now over 27 MB/s (4.6M words/s),
>> using '[a-z]{0,5}'. This is still a bottleneck for very fast formats but,
>> well, any way of producing candidates is and with the finer granularity of
>> a regexp you might gain total time anyway.
>>
>>> BTW, we've been able to crack a bunch of passwords during a pentest
>>> with rexgen and JtR, because we had an idea about how the passwords
>>> could look like and we could describe this using a simple regex :-)
>>
>>
>> Yes, for some patterns (with variable length parts like "abc[0-9]{1,3}def"
>> there's just no way to do it (that easily) with any other tool I know of.
>> Not to mention wilder regexps and back references!
>>
>> Like I just wrote in another post I'd love to have this as a native mode
>> in JtR but we can't use C++. OTOH, maybe we can add a HAVE_REXGEN in
>> Makefile, stating that we have librexgen installed, and write a mode in C
>> that just calls the lib.
>>
>> BTW did you see my suggestion of supporting append/prepend to words read
>> from stdin? That would be awesome.
>>
>> magnum
>>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
