Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 25 Jan 2024 15:39:19 +0100
From: Solar Designer <>
Subject: Re: DES passwords not cracked within hours

On Thu, Jan 25, 2024 at 06:57:46AM +0100, Matthias Apitz wrote:
> As I said, I used the same installation tree as in October 2022. At this
> time I could crack a password in ~20 minutes as the files proof:
> ~/guru/john-1.9.0-jumbo-1/run> ls -ltr --full-time john.pot /tmp/pins.des
> -rw-r--r-- 1 sisis sisis 104 2022-10-13 13:25:49.403363915 +0200 /tmp/pins.des
> -rw------- 1 sisis sisis  21 2022-10-13 13:44:58.261868507 +0200 john.pot
> ~/guru/john-1.9.0-jumbo-1/run> cat john.pot
> aAwfYXwckrtz6:010473
> The actual DES hash has the same length and the clear PIN only consists
> of 6 chars: one small letter, 4 digits and the #-symbol. And it's still
> running and after ~17 hours w/o any result.

Like you say, these two passwords are of different complexity (one is
all digits, the other not), and so they reasonably take different time
to crack (by the default invocation, which tries more common kinds of
passwords first).  Since you know so much about the password, you can
indeed focus the attack.  For example:

./john --length=6 passwd.des


./john -9='a-z0-9#' -mask='?9' -length=6 passwd.des

or even:

./john -mask='?l?d?d?d?d#' passwd.des

The latter should complete instantly.

Separately, I recommend that you don't misuse /tmp.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.