Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 09 May 2015 19:34:38 +0200
From: Marek Wrzosek <marek.wrzosek@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: bleeding-jumbo - How case and alpha options of regex mode suppose
 to work?

W dniu 08.05.2015 o 23:13, Marek Wrzosek pisze:
> Hi
> 
> How case and alpha options suppose to work?
> In standalone regex mode command line:
> ./john --regex=case="pass" --stdout
> will print:
> case=pass
> To achieve what I wanted, I had to run something like this:
> ./john --regex="(?i:pass)" --stdout
> and output is:
> pass
> Pass
> PAss
> pAss
> pASs
> PASs
> PaSs
> paSs
> paSS
> PaSS
> PASS
> pASS
> pAsS
> PAsS
> PasS
> pasS
> 
> As expected. But with wordlist or stdin mode these options work
> differently, e.g.:
> $ echo "pass"|./john --stdin --regex=case=alpha:case="\0" --stdout
> buf=[pP][aA][sS][sS]
> pass
> Pass
> pAss
> PAss
> paSs
> PaSs
> pASs
> PASs
> pasS
> PasS
> pAsS
> PAsS
> paSS
> PaSS
> pASS
> PASS
> 16p 0:00:00:00 0.00% 88.88p/s PASS
> 
> but without =case option:
> $ echo "pass"|./john --stdin --regex=alpha:case="\0" --stdout
> buf=pass
> pass
> 1p 0:00:00:00 0.00% 4.166p/s pass
> 
> the same is with:
> $ echo "pass"|./john --stdin --regex=case="\0" --stdout
> pass
> 1p 0:00:00:00 0.00% 4.545p/s pass
> 
> =alpha option for leet, leet2 and leet3 parameters is working as
> expected, but need =case option to work with leet2_case and leet3_case
> alphabets. With leet+c =alpha option does not need =case option. And of
> course there is no leet_case alphabet in regex_alphabets.conf file.
> 
> Maybe someone should revise README.librexgen file.
> Undocumented - it's a bug, documented it'll be a feature ;-)
> 
> Bests
> 
There is another "trick" with librexgen enabled JtR. The combination of
case and alpha options with something more than "\0" will cause this:
$ echo "pass"|./john --stdin --regex=case=alpha:case="\0b" --stdout
buf=[pP][aA][sS][sS]
error: syntax error, unexpected $end, expecting T_END_CLASS
Error, invalid regex expression.  John exiting now  base_word=pass
Regex= [pP][aA][sS][sSb

You need to add ] between \0 and your string.
$ echo "pass"|./john --stdin --regex=case=alpha:case="\0]b" --stdout
buf=[pP][aA][sS][sS]
passb
Passb
pAssb
PAssb
paSsb
PaSsb
pASsb
PASsb
pasSb
PasSb
pAsSb
PAsSb
paSSb
PaSSb
pASSb
PASSb
16p 0:00:00:00 0.00% 100.0p/s PASSb

Strange thing is that "\0" and "\0]" are equivalents - there are no
errors. The strangest things happen when you add something more
complicated than simple string before \0:
$ echo "pass"|./john --stdin --regex=case=alpha:case="(?i:r|d|t|f)\0"
--stdout
buf=[pP][aA][sS][sS]
rpass
Rpass
dpass
Dpass
tpass
Tpass
fpass
Fpass
Pass
dPass
DPass
tPass
TPass
fPass
FPass
pAss
dpAss
DpAss
tpAss
TpAss
fpAss
FpAss
PAss
dPAss
DPAss
tPAss
TPAss
fPAss
FPAss
paSs
dpaSs
DpaSs
tpaSs
TpaSs
fpaSs
FpaSs
PaSs
dPaSs
DPaSs
tPaSs
TPaSs
fPaSs
FPaSs
pASs
dpASs
DpASs
tpASs
TpASs
fpASs
FpASs
PASs
dPASs
DPASs
tPASs
TPASs
fPASs
FPASs
pasS
dpasS
DpasS
tpasS
TpasS
fpasS
FpasS
PasS
dPasS
DPasS
tPasS
TPasS
fPasS
FPasS
pAsS
dpAsS
DpAsS
tpAsS
TpAsS
fpAsS
FpAsS
PAsS
dPAsS
DPAsS
tPAsS
TPAsS
fPAsS
FPAsS
paSS
dpaSS
DpaSS
tpaSS
TpaSS
fpaSS
FpaSS
PaSS
dPaSS
DPaSS
tPaSS
TPaSS
fPaSS
FPaSS
pASS
dpASS
DpASS
tpASS
TpASS
fpASS
FpASS
PASS
dPASS
DPASS
tPASS
TPASS
fPASS
FPASS
113p 0:00:00:00 0.00% 664.7p/s FPASS

The first string (r in this example) is outputed only for the first
combination of piped string, for every next combination the first string
is empty.

-- 
Marek Wrzosek
marek.wrzosek@...il.com

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.