Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 14 Apr 2014 02:33:31 +0200
From: magnum <john.magnum@...hmail.com>
To: john-users@...ts.openwall.com
Subject: Re: EXTRA characters.

On 2014-04-12 16:20, Adriano Di Luzio wrote:
> Hi, I’m using JtR to crack for an academic project some old Unix
> password hashes. I created my custom charset (lower alpha and
> numbers), and I was wondering about Extra characters in config.

> What does "least probable" means? How does it affect interactive
> mode? Is it better to create a custom charset having the special
> symbol I need, or using the “Extra” section?

When you build a charset file, what you really do is store character 
probabilities for each position, taking preceeding characters into 
account as well. This is vastly different from dumb brute force provided 
you train it on real-world data. But you might be short on real-world 
data and somehow know a couple of characters that should be included 
even though they do not appear in your training data - and this is what 
the option is for.

You can watch your charset in action using eg:

$ ./john -stdout -inc:custom | head

$ ./john -stdout=4 -inc:custom | tail

Using an alnum charset made from the Rockyou dataset, the first word 
produced is "123456" (indeed a good real-world guess) while the very 
last is "qxqj" when limited to four characters (the "tail" test would 
take too long without a limit).

You can also check how many guesses it takes to reach a certain word, if 
it's not too unprobable:

$ ../run/john -stdout -inc:lowernum | grep -nm1 '^suzuki$'
270501:suzuki

Now bump CharCount to 38 and add a line "Extra = XY" in john.conf for 
that mode. It will now generate passwords using lower alpha, digits and 
those two upper-case characters. Check the tail for length 4 again and 
you'll see that the last candidate is YYYY. The first word containing 
any of the extra characters (a single "X") is #22984 when limited to 
length 4, but beyond 400 million if not (I aborted after a couple of 
minutes).

BTW the "Extra" stuff is apparently b0rken in bleeding-jumbo. I'll have 
a look at that.

magnum

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.