John-The-Ripper can not find charset

Question

I am trying out john the ripper to guess the password of a test.pdf file. I know the password is 8 characters long and I know it uses only letters and numbers as described by this regex [a-zA-Z0-9]{8}.

But I am getting the error: No charset defined for mode: CustomCharset.

Here's exactly what I did:

mkdir john;
cd john;
git remote add origin https://github.com/openwall/john.git;
git checkout bleeding-jumbo;
git pull origin bleeding-jumbo;

cd src;
./configure --without-openssl && make

I added this to the bottom of the ~/john/run/john.conf file:

[Incremental:CustomCharset]
MinLen = 8
MaxLen = 8
CharSet = ?l?u?d

I grab the password hash liek this:

python3 ~/john/run/pdf2john.py ~/test.pdf > ~/test.hash

Then run this command

~/john/run/john --config=~/john/run/john.conf --incremental=CustomCharset --format=pdf ~/test.hash

But I get the error No charset defined for mode: CustomCharset.

What did I do wrong?

Answer 1

John expects an actual charset file (ending .chr) for incremental mode - the default ones usually live in /usr/share/john/*.chr. So it's looking for CustomCharset.chr - which doesn't exist.

The charset files contain far more than just the keyspace - they have a load of information about character frequency, common digraphs and trigraphs, etc to make incremental mode more efficient.

If you know something about the structure of the password you could try and generate your own charset using the --make-charset option - but if not then you can just use mask mode to do a dumb attack. The ?1 mask matches your regex, so you can do:

john --mask='?1?1?1?1?1?1?1?1'

That'll take a long time to run unless you're running it on some pretty beefy hardware though. So you may also be able to save some time by making some initial assumptions about the password. For example there's a good chance the capital is at the start and the number at the end - so that might be worth trying a mask like ?u?l?l?l?l?l?l?d first.