Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 17 Apr 2016 07:34:26 -0500
From: jfoug <>
Subject: HashCat rule handling (in jumbo)

On 4/10/2016 11:26 AM, jfoug wrote:  (On john-dev)
> I have added HashCat rule (and logic changes) handling within 
> john-bleeding.  This change has not been committed to the 
> bleeding-jumbo branch yet, but there is a full patch file on the 
> github issue where it is being discussed: 

The hashcat logic is now fully implemented within bleeding github tree.

I have also added a '2nd' title case command.  Hashcat added the 'E' 
rule, which is title case based solely upon space character separators. 
The eC and e?C rules are extensions to this. They allow any character 
(or class of characters) to be used as the separator for title casing.

All hashcat .rule files can not be used unchanged within bleeding jumbo. 
They simply need to be 'included' in a section within your 
john-local.conf file (which you may have to create). The syntax within 
your john-local.conf file to get this working properly is:

!! hashcat logic ON
.include 'dive.rule'
!! hashcat logic OFF

The "!! hashcat logic ON/OFF" syntax is needed since the input between 
the 2 tools is very different. Hashcat does not support the 
pre-processor which john has. Thus, none of the special characters in 
hashcat rules will be escaped properly.  So we need to tell john to NOT 
use the preprocessor when loading the data from these files. Also, 
hashcat does not have the character classes which john uses, so things 
like @? mean to purge all ? characters in hashcat, while in john, it 
would be interpreted as a 'broken' command since the ? means a class, 
but we have not provided the class character.  So in hashcat mode we 
would see @?  but in normal john rules, we would see @?? for the same 
command.  Other things which are taken into account, is that hashcat 
rules can start with a [ character, or with a . character.  Both of 
those have special meaning to the .conf file loader, and cause problems. 
Thus, in hashcat loading mode, those lines are treated as rules.

The new rule commands are documented in the new ./doc/RULES-hashcat 

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.