[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 10 Nov 2020 17:01:24 +0100
From: François <francois.pesce@...il.com>
To: "john-users@...ts.openwall.com" <john-users@...ts.openwall.com>
Subject: Re: Rules characters unicode support.
Alexander,
I've just finished writing the john.conf using your micro-optimization
trick.
Three last questions before creating a pull request:
1- On my experimental file I'm working on, this rule is surprisingly
effective (hundreds of pass cracked), however, I specifically does
not have uppercase in my sample, so my john.conf change just
contains lowercase utf-8, do you want me to add uppercase?
2- Correct me if I'm wrong but there are no obvious search and
replace strategy for any pattern of more than one letter in john rules
engine; I'm thinking two-letter substitution to one unicode,
specifically:
# Latin small letter thorn (th) -> þ
# Latin small letter ae -> æ
# Latin small letter oe -> œ
# Latin small letter eszett (ss) -> ß
I think those would be efficient additions too.
3- Do you want me to provide the rules in a best-match order,
it might get a bit confusing, I can group by best unicode substitution
order.
Francois Pesce
On Sun, Nov 8, 2020 at 8:28 PM Solar Designer <solar@...nwall.com> wrote:
> On Tue, Nov 03, 2020 at 08:16:42PM +0100, Solar Designer wrote:
> > /e Dp Ap"é"
> >
> > This is three commands: search for one character, delete the found
> > character, insert a possibly multi-character string (in our case, just
> > a multi-byte character) in the former character's place.
> >
> > You can also specify the multi-byte character via its hex codes, which
> > makes the .conf file format character set agnostic (so you can have any
> > character set active in your text editor, and it won't matter):
> >
> > /e Dp Ap"\xc3\xa9"
> >
> > However, the rules are indeed not character set agnostic - as written
> > above, the rule produces UTF-8.
> >
> > A difference from the "s" command is that the above rule will find and
> > replace only the first match, whereas "s" would find and replace all.
> >
> > You can reduce this difference by writing multiple rules like this:
> >
> > /e Dp Ap"\xc3\xa9"
> > /e Dp Ap"\xc3\xa9" /e Dp Ap"\xc3\xa9"
> > /e Dp Ap"\xc3\xa9" /e Dp Ap"\xc3\xa9" /e Dp Ap"\xc3\xa9"
> >
> > You can also choose which instances of the character you replace, e.g.
> > to replace only the second:
> >
> > %2e Dp Ap"\xc3\xa9"
>
> You can also micro-optimize these, e.g.:
>
> /e op\xa9 ip\xc3
> %2e op\xa9 ip\xc3
>
> This is overstrike and insert, which is quicker than delete and insert
> (since deleting involves shifting the rest of the string to the left).
>
> François, would you possibly create a reusable ruleset implementing
> these various substitutes and submit it via a GitHub pull request for
> inclusion in jumbo's default john.conf? Also have it .include'ed from
> [List.Rules:Jumbo]. Thanks!
>
> Alexander
>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
