5

Given two different known passwords, let's just call them A and B for now, what is the fastest way to compare their strength with John the Ripper?

I know that I could just add two users to my Linux system and run john on my /etc/shadow. It will be more efficient to then just extract those two users from /etc/shadow and run john on those two only. But that would still use Blowfish or whatever secure algorithm is used, and I do not want to test the algorithm, just the passwords. I could configure my system to a weaker algorithm for that purpose. But I'm looking for an even smarter, faster way. Preferably even adding a custom dictionary for words that might be used in one of the passwords.

The actual use case is to compare the strength between:

  • a slightly longer password that contains words from a dictionary but is obfuscated to use characters from four character classes
  • a slightly shorter password that uses characters from three character classes but no dictionary entries
  • hashcat also specifically has hash type 99999, plaintext, designed for debugging and exactly what you're referencing here, just seeing how long it takes to find a match. – Anti-weakpasswords Jan 19 '18 at 4:54
11

There's essentially no way to determine which password is stronger in absolute terms because the strength of passwords depends on the way an attacker is approaching cracking the passwords. However, it is possible to figure out (for a given wordlist and set of mangling rules) which one would be cracked first by an attacker.

Start by determine what wordlist and rules you want to use. I would probably use the rockyou.txt wordlist that is well known and combine it with one of the rulesets listed on the openwall wiki.

You can run john in a mode where, rather than cracking passwords, it will just generate the candidate passwords to be tried. This is called stdout mode. For example, you can use:

john --wordlist=rockyou.txt --rules=Korelogic --stdout

This will produce a list of all of the candidate passwords, in the order that they would be tried by JtR. If you have enough disk space, you can just tee this to a file for later analysis. If you really only care about the two (or so) passwords you're studying, you can just grep for those to get the order they would be tried:

john --wordlist=rockyou.txt --rules=Korelogic --stdout | grep -E -n '^(password1|password2)$'

Thanks to Hector for reminding me of the -n flag to grep. This will give you the line number for each of the passwords when attempted, showing you (relatively) how far down the generated password list they are -- in other words, how quickly an attacker gets to them.

Alternatively, grep as follows (suggested by dave_thompson_085) to not care about special characters:

john --wordlist=rockyou.txt --rules=Korelogic --stdout | grep -n -x -F -e 'password1' -e 'password2'
  • 6
    Can I suggest a simple edit - rather than use ts you could use "grep -n". This gives you the line count (effectively the number of passwords tried until it hit this one (inclusive). Considering the variations between machines and hash algorithms i'd argue this a far better measure than ts. – Hector Jan 18 '18 at 8:07
  • 2
    @Hector I'm embarrassed to admit that I did not think of using -n for that, despite the fact that I'm well aware of its existence... thanks for the catch! – David Jan 18 '18 at 15:15
  • 1
    ( | ) are extended (not basic) regex syntax and on non-GNU grep's need backslashes or -E. Alternatively (!) use grep -n -e '^pw1$' -e '^pw2$' or simpler grep -n -x -e 'pw1' -e 'pw2' and then adding -F correctly handles passwords containing regex specials . * \ [ and maybe ? + ( | { -- some of which are reasonably likely. (-n -F -x -e are all POSIX.) – dave_thompson_085 Jan 19 '18 at 4:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.