[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 29 Dec 2020 23:32:26 +0100
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Cc: Jeff Johnson <echo5juliet@...il.com>
Subject: Re: use data from known password zipfile created by the same machine/user?
On Tue, Dec 29, 2020 at 11:57:15AM -0500, Robert Dixon wrote:
> Use your best guess as to what the password could be. How many characters?
> Do you remember part of it? What characters could you have used? Do you
> have any idea of the positions of any of the characters?
These are all good questions to start with ...
> Take all that information and use Crunch to create a word list.
... but why Crunch? Both JtR and hashcat have its functionality
built-in. They can generate candidate passwords from a mask and then
test them directly, or if you really insist then write to a file, too
(that's the "--stdout" option to "john").
> If your best guess with
> all of that works your golden if not change one variable and make another
> Crunch list keep doing that until you get the password. If your best guess
> is good then you shouldn't need to make that many lists. The reason I'm
> saying to do it this way is you can control what happens in a particular
> position of the password. If you know the third character will be a number
> and the fifth will be a special symbol then that drastically cuts down on
> the amount of guesses. If you let the program make random guesses then your
> adding in far more than you need to deal with.
Sure. We don't yet know if whatever Jeff recalls about the password can
be represented as a mask, though. It might as well require applying
leetspeak to pairs of words.
> I'm not knocking JTR but if
> you have even a half decent Nvidia GPU try Hashcat. I have a RTX 2070 and
> it can go through a 9 or 10 GB list in a few hours with Hashcat it's a
> little slower with JTR.
It sounds like your comparison is for something other than a PKZIP
archive (maybe WinZip, or something else entirely). For PKZIP, the
speed of pure wordlist attacks would be limited by disk reads (yet
another reason to avoid Crunch), and in your example would be in seconds
or at most minutes (SSD or RAM vs. HDD), not hours. This is really not
how attacks on PKZIP archives should be run.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
