Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is:

$hash = md5($salt . $pass)

No other transformation is performed nor in the $salt or in the pass, I've manually checked one example. I've found in the documentation that the sub-format that goes with the algorithm is dynamic_4. The problem is that passwd file format as written in documentation, doesn't seems to work, John is unable to load the hashes, this is the format that I've used:

// user:$dynamic_4$hash$salt
emi:$dynamic_4$83a3f08cfb2d9d0bac5d1a1619d8b7dd$Z3MkG2FZsaoV9EDCpmSRWvgANQAeXOeN7oadrAugu0rKEvfKqoNj6D9a

I've tried to change the salt for the hash but still nothing

I've tried the following parameters combination:

john --single passwd
john --format=dynamic_4 --single passwd
john --subformat=dynamic_4 --single passwd
john --format=md5 --single passwd
john --format=raw-md5 --single passwd
share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

I've looked John the ripper source code and your syntax of using John The Ripper .

  • In john the ripper dynamic hash subformats salts lenght are limited .
src/dynamic_preloads.c: 

static DYNAMIC_Setup Setups[] =
{
    { "dynamic_0: md5($p) (raw-md5)",           _Funcs_0, _Preloads_0, _ConstDefault, MGF_NO_FLAG, MGF_KEYS_INPUT },
    { "dynamic_1: md5($p.$s) (joomla)",         _Funcs_1, _Preloads_1, _ConstDefault, MGF_SALTED, MGF_NO_FLAG, -32 },
    { "dynamic_2: md5(md5($p)) (e107)",         _Funcs_2, _Preloads_2, _ConstDefault, MGF_NO_FLAG, MGF_KEYS_INPUT|MGF_SET_INP2LEN32 },
    { "dynamic_3: md5(md5(md5($p)))",           _Funcs_3, _Preloads_3, _ConstDefault, MGF_NO_FLAG, MGF_KEYS_INPUT|MGF_SET_INP2LEN32 },
    { "dynamic_4: md5($s.$p) (OSC)",            _Funcs_4, _Preloads_4, _ConstDefault, MGF_SALTED, MGF_NO_FLAG, -24  },
    { "dynamic_5: md5($s.$p.$s)",               _Funcs_5, _Preloads_5, _ConstDefault, MGF_SALTED, MGF_NO_FLAG, -12, 31, 56  },
    { "dynamic_6: md5(md5($p).$s)",             _Funcs_6, _Preloads_6, _ConstDefault, MGF_SALTED, MGF_KEYS_BASE16_IN1, -23, 55, 80 },
    ...
    ...
    ...

for example dynamic_0 is 32 byte,dynamic_4 is 24 byte,dynamic_5 is 12 byte, and ... .

You must modify the source code and recompiling JTR for supporting more than defualt value for salts .


  • dynamic_4 field is not allow in passwd file .

Simple of cracking a salted hash :

sajjad@xxx:~/Downloads/john-1.7.9-jumbo-7/run$ cat pass.txt
admin:d5fedea70cf14c3191fc8e94fe4ca8b9$Y0g7Wx78AdpjIdZd

sajjad@xxx:~/Downloads/john-1.7.9-jumbo-7/run$ ./john -form=dynamic_1 -w=password.lst keys.txt
Loaded 1 password hash (dynamic_1: md5($p.$s)  (joomla)  [128x1 (MD5_Body)])
admin            (admin)
    ...
    ...
    ...
share|improve this answer
    
Not yet compiled john, but with the syntax you suggested and a smaller salt. John perfectly accepts it. So that's the problem. –  user2253620 Sep 20 '13 at 20:14
    
Yes,It must to be report, you can report this problem to JohnTheRipper github issues. github.com/magnumripper/JohnTheRipper/issues –  Sajjad Pourali Sep 20 '13 at 20:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.