Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is a basic example of an Unix Pass Encryption.

I have a little Hash of MD5 ARP:

user50:$apr1$w7YNTrjQ$0/71H7ze5o9/jCnKLt0mj0
user60:$apr1$AIw2h09/$Ti0TRlU9mDpCGm5zg.ZDP.

I need to find the pass of two users: user50 & user60.

I was wondering, what is the best way to crack this hash? Maybe with John the Ripper? Is there a better alternative?

share|improve this question

migrated from crypto.stackexchange.com Mar 4 '14 at 17:00

This question came from our site for software developers, mathematicians and others interested in cryptography.

I would suggest John the Ripper. Get a large dictionary file and run it through John. You could even split it among multiple machines (possibly in the cloud) as the problem is very parallelizable.

John can even do variations on dictionary words like substituting 0 for o.

For more info, see this article.

If you have access to a GPU, oclHashcat looks interesting.

share|improve this answer
    
Well i use John the ripper. I know the length of the pass is : 7. I try to configure John for search only pass with lenght = 7, but i don't find the option... Do you know what is the option ? – mpgn Mar 4 '14 at 17:45
    
Take your dictionary file and run it through john with --stdout=7. This will produce a dictionary file where all passwords are no more than 7 characters. See EXAMPLES (search for --stdout on that page and you will see an example). – mikeazo Mar 4 '14 at 17:54
    
Yeah, --stdout only work with a wordlist, it's not possible with basic option like ../john --stdout=7 pass – mpgn Mar 4 '14 at 17:59
    
See this then: openwall.com/john/doc/CONFIG.shtml and look at "Incremental" mode parameters – mikeazo Mar 4 '14 at 18:01
    
the documentation looks like years 1995... – mpgn Mar 4 '14 at 18:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.