Date: Wed, 14 Sep 2016 22:29:23 +0200 From: magnum <john.magnum@...hmail.com> To: john-users@...ts.openwall.com Subject: Re: Error: wordlist contains NULL bytes - aborting On 2016-09-14 21:51, Patrick Proniewski wrote: > On 14 sept. 2016, at 21:37, Frank Dittrich wrote: > >> "cracking" SHA1 hashes of random garbage bytes are hardly a use case >> john should support, IMHO. >> >> Is there any system which really accepts random bytes including line >> feeds and null bytes in passwords? >> How do you enter such passwords as a user? And even if you can, should >> you ever do this? >> >> How would you know (as a user who didn't audit the system in use) that >> the system will not silently convert your >> >> "pass\0word" into pass? > > > There are use case for this kind of exotic passwords: internal passwords, service accounts, etc. If you have coded the application you can make it support this kind of oddities. There's no problem at all writing a cracker that can handle null bytes. Hashcat does, but JtR doesn't. The legacy core code doesn't, the pot file format doesn't, and so on. "Fixing" that would be a HUGE task for a next-to-none benefit, it just wont happen. There could be some performance benefits of using "pascal strings" though, passing lengths between functions instead of repeatedly doing strlen(). I'd like to point out there is one "exception" though: UTF-16 passwords that have null *bytes* as part of their 16-bit *characters* (eg. the upper half of ISO-8859-1) obviously work just fine. That's because all internal handling as well as the pot file entry will be using a codepage or UTF-8 encoding. BTW technically we could cheat and add support for null bytes by allowing MUTF-8 (see https://en.wikipedia.org/wiki/UTF-8#Modified_UTF-8) throughout core with VERY little changes (shared code), which would make it work just fine right up to each format's set_key() function. But then we'd need to add a little decoding to each format that we want able to use it. This could be implemented if there would be popular demand for it - but I really doubt many people would need it. magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.