Date: Wed, 14 Sep 2016 15:10:30 -0500 From: jfoug <jfoug@...nwall.net> To: john-users@...ts.openwall.com Subject: Re: Error: wordlist contains NULL bytes - aborting On 9/14/2016 2:37 PM, Frank Dittrich wrote: > Hi Marek, > > Am 14.09.2016 um 21:32 schrieb Marek Wrzosek: >> If the problem is storing those passwords in pot file, maybe >> percent-encoding (like in URLs) would do the trick. It should be >> backward compatible - the old pot file will work with new john, but not >> the other way around. > > "cracking" SHA1 hashes of random garbage bytes are hardly a use case > john should support, IMHO. If you actually convert the data presented (the found passwords), they actually appear to be real world data. The majority are ISO8859-1 and there are some utf-8 mixed in. Yes there are some obscure data (some < 0x20 escape chars, such as the \xd \xa and \x0 stuff). But all in all, if you look at the overall data found, I would think it looks like passwords. > Is there any system which really accepts random bytes including line > feeds and null bytes in passwords? > How do you enter such passwords as a user? And even if you can, should > you ever do this? Who knows. John has limitations, due to design. It is a C program, runs in ASCII mode (mostly). Stored 'text' files. So we have certain things that are magic and harder to deal with. Those things are things like the \n \r and \0 type data. Yes, we 'could' handle this (in fact ALL of this). But about the only way short of a blind mask mode, is to keep all data in a hex mode (including forcing wordlists to be converted INTO hex mode) to hide the \0 \r \n characters. This is NOT something that will be done for john. So take it for what it can do.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.