john-users - Issue Applying Rules to Tokenized in John the Ripper

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGSLPCZ450hSoLxLDDx2gk4t9=tjxZHPc8DqXti3qsF5DOybNQ@mail.gmail.com>
Date: Thu, 27 Mar 2025 05:08:16 +0530
From: Pentester LAB <pentesterlab3@...il.com>
To: john-users@...ts.openwall.com
Subject: Issue Applying Rules to Tokenized in John the Ripper

I am reaching out to seek assistance regarding an issue I encountered while
attempting to apply rules to a tokenized  using John the Ripper (JtR).
Steps Taken:

   1.

   I created a test input file named test.txt with the following content:

abc
@
123

   2.

   I used JtR's default tokenizer to process the file:

perl tokenize.pl test.txt > test_token.txt

   3.

   The content of test_token.txt is as follows:

# sed '/[^ -~]/d; s/123/\x1/g; s/abc/\x2/g; s/12/\x3/g; s/bc/\x4/g;
s/23/\x5/g; s/ab/\x6/g; s/a/\x7/g; s/1/\x8/g; s/b/\x9/g; s/2/\xb/g;
s/@/\xc/g; s/c/\xe/g; s/3/\xf/g; s/^/:/'

[List.External:Untokenize]
int mod[0x100];

void init() {
    for (int i = 0; i < 0x100; ++i) mod[i] = i;
    mod[1] = 0x333231; // "123"
    mod[2] = 0x636261; // "abc"
    mod[3] = 0x3231;   // "12"
    mod[4] = 0x6362;   // "bc"
    mod[5] = 0x3332;   // "23"
    mod[6] = 0x6261;   // "ab"
    mod[7] = 0x61;     // "a"
    mod[8] = 0x31;     // "1"
    mod[9] = 0x62;     // "b"
    mod[11] = 0x32;    // "2"
    mod[12] = 0x40;    // "@"
    mod[14] = 0x63;    // "c"
    mod[15] = 0x33;    // "3"
}

void filter() {
    int i = 0, j = 0, k = 0, save[0x80];
    while (save[i] = word[i]) i++;
    while (int m = mod[save[j++]]) {
        word[k++] = m;
        while (m >>= 8) word[k++] = m;
    }
    word[k] = 0;
}

   4.

   I attempted to crack the hash using the following command:

john --format=raw-md5 --wordlist=test_token.txt
--rules=KoreLogic,Best64 md5.hash

Issue Observed:

   -

   JtR correctly loaded the tokenized wordlist, but it appears that the
   selected rules (KoreLogic, Best64) were not applied during the cracking
   attempt.
   -

   The session completed without any successful cracks, and no rule-based
   transformations seemed to have been executed on the tokenized input.

Request for Assistance:

I would appreciate guidance on:

   -

   Ensuring that rules are correctly applied to tokenized.
   -

   Identifying if there are any misconfigurations or additional parameters
   needed.

Thank you for your support.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.