Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 14 Sep 2016 22:29:23 +0200
From: magnum <>
Subject: Re: Error: wordlist contains NULL bytes - aborting

On 2016-09-14 21:51, Patrick Proniewski wrote:
> On 14 sept. 2016, at 21:37, Frank Dittrich wrote:
>> "cracking" SHA1 hashes of random garbage bytes are hardly a use case
>> john should support, IMHO.
>> Is there any system which really accepts random bytes including line
>> feeds and null bytes in passwords?
>> How do you enter such passwords as a user? And even if you can, should
>> you ever do this?
>> How would you know (as a user who didn't audit the system in use) that
>> the system will not silently convert your
>> "pass\0word" into pass?
> There are use case for this kind of exotic passwords: internal passwords, service accounts, etc. If you have coded the application you can make it support this kind of oddities.

There's no problem at all writing a cracker that can handle null bytes. 
Hashcat does, but JtR doesn't. The legacy core code doesn't, the pot 
file format doesn't, and so on. "Fixing" that would be a HUGE task for a 
next-to-none benefit, it just wont happen. There could be some 
performance benefits of using "pascal strings" though, passing lengths 
between functions instead of repeatedly doing strlen().

I'd like to point out there is one "exception" though: UTF-16 passwords 
that have null *bytes* as part of their 16-bit *characters* (eg. the 
upper half of ISO-8859-1) obviously work just fine. That's because all 
internal handling as well as the pot file entry will be using a codepage 
or UTF-8 encoding.

BTW technically we could cheat and add support for null bytes by 
allowing MUTF-8 (see 
throughout core with VERY little changes (shared code), which would make 
it work just fine right up to each format's set_key() function. But then 
we'd need to add a little decoding to each format that we want able to 
use it. This could be implemented if there would be popular demand for 
it - but I really doubt many people would need it.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.