Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 18 Mar 2020 14:48:31 -0700
From: Dan Tentler <>
Subject: Trouble with displaying cracked passwords

We're on an engagement, and we've been able to extract the credentials 
out of the wordpress database for a blog the customer runs.
There are a few hundred hashes in here, and some of them appear to be 
terrible stuff like 'password' and 'testtest' and whatnot.

Trouble is, when I handed them to jtr I just put a bunch of hashes in a 
text file, and now I need to join the cracked password to the account 
it's from for further processing. I figured since the cracked hashes 
would land in john,pot, i could just create a new text file with 
email:hash and aim jtr at that thing and it would say 'oh hey a bunch of 
hashes I already cracked', and I could do something like john --show 
filename.txt and it would give me email:pass, but no such luck.

It looks like the hash thats landing in john.pot isnt the same format 
which is in the text file, which is REALLY WEIRD and I'm not sure what's 
going on.

So I guess, tl;dr: it doesnt look like jtr handles the phpass hashes 
very well? Any help would be appreciated.
running magnumripper jtr with a date of march 4th (I don't have the 
exact git branch handy)


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.