Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to figure out how (if it is possible) to use them against XKCD 936 style passphrases

I've seen character classes:

?w  matches whitespace: space and horizontal tabulation characters
?a  matches letters [a-zA-Z]

Will a ?a?w?a?w?a?w?a work to match a four word grouping? I think that that would match 4 characters with whitespace--not sure how to match whole words with that. Suggestions? I have a good idea that there aren't any character substitutions or anything.

Alternatively, should I just be taking my wordlist and generating groupings of four and hashing/checking them without JtR?

Cheers

Related question

share|improve this question

1 Answer 1

up vote 2 down vote accepted

DISCLAIMER: I'm neither JtR user nor Perl programmer. This answer that follows is a product of years of training in Google-Fu alone, combining a few answers from newsgroups and some JtR documentation.

John the Ripper (JtR) rules do not support multiple input words.

The only exception is with the single crack mode where operators 1, 2, and + control if other commands are applied to the first, the second, or to both words respectively, when testing against a word pair, such as first and last name.

Alternatively, you could redirect the output of an external script (handling word combinations) either into a john --stdin or into a file (and use that as a wordlist with JtR). Doing so will obviously slow down the process as the number of possible combinations increase exponentially with the number of input arguments, thus is probably only worth trying on really short word lists.

Here are some Perl scripts that you could adopt to suit your needs (or use as is?):

Two word combinations:

#!/usr/bin/perl

while (<>) {
    chop;
    $w[$#w + 1] = $_;
}

foreach $a (@w) {
    foreach $b (@w) {
        print "$a$b\n";
        print "$a $b\n";
    }
}

Three word combinations:

#!/usr/bin/perl

while (<>) {
    chop;
    $w[$#w + 1] = $_;
}

foreach $a (@w) {
    foreach $b (@w) {
        $ab = "$a$b";
        $a_b = "$a $b";
        foreach $c (@w) {
            print "$ab$c\n";
            print "$a_b $c\n";
        }
    }
}

Four word combinations:

#!/usr/bin/perl

while (<>) {
    chop;
    $w[$#w + 1] = $_;
}

foreach $a (@w) {
    foreach $b (@w) {
        $ab = "$a$b";
        $a_b = "$a $b";
        foreach $c (@w) {
            $abc = "$ab$c";
            $a_b_c = "$a_b $c";
            foreach $d (@w) {
                print "$abc$d\n";
                print "$a_b_c $d\n";
            }
        }
    }
}
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.