Date: Wed, 26 Feb 2014 02:22:31 +0100 From: magnum <john.magnum@...hmail.com> To: john-users@...ts.openwall.com Subject: Re: Secure Mode for John On 2014-02-21 00:25, Mark Butler wrote: >> Date: Tue, 21 Jun 2005 16:28:29 -0400 >> From: Jim Brown <jpb@...shooter.v6.thrupoint.net> >> >> I've used john in an enterprise environment as a strong >> password compliance tool and I've had these concerns: >> >> 1. The passwords are visibly displayed. >> 2. The .pot file contains password data that can be displayed >> by running john at a later time. > > I would like to revisit the above. Ideally I would like a setting in > john.conf to be able to turn on Secure Mode for john. I would envisage that > when it is set, instead of john passing back the clear text password, it > would pass back attributes of the password instead. Things like length, > mode john is running in (Single crack [S], Wordlist [W], Incremental [I], > External [E]) and the rule matched in that mode. eg: L8-W-R13 for a > password 8 characters in length, cracked in Wordlist mode using rule 13. > Hopefully all this information is available to john at the time the > password is cracked. A first try is now committed to bleeding-jumbo. Enable by setting SecureMode=Y in john.conf. It turned out to be a too intrusive patch writing stuff like modes & rule numbers - and you can see such things in the log anyway. What it does instead is showing what character classes are involved. Is that too much information? For example, the password "Ignit3" would output as L6-?l?d?u telling you that it's six characters long and consists of lowercase, digits and uppercase characters. It does not hint about order or amounts of each class. The classes are printed in mask-mode syntax: ?l ?u ?d ?s ?a for lower-case, upper-case, digits, specials and 8-bit. > The flow on effect would be the .pot file would include the encrypted > password with password attributes instead of the clear text password. The current patch writes that same "L6-?l?d?u" string to log, pot file and to screen. I can't see it go very wrong but everything I do is on a best-effort basis so please test ;-) Oh, and when this is activated, the default potfile is secure.pot so you don't accidentally mix formats in john.pot. This can still be overridden using --pot=FILE. Review my patch here: https://github.com/magnumripper/JohnTheRipper/commit/633a45f Snapshot tarball: https://github.com/magnumripper/JohnTheRipper/tarball/bleeding-jumbo magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.