Never expect to crack 100% of hashes.
To crack hashes, John the Ripper iteratively tries to input candidate passwords into the hash function and checks if there is a match. If it tries every word in the dictionary you provide it, or if it has exhausted the combinations you have set it to use without having cracked every hash, then naturally it will stop ...
I'm not aware of a way to pass a list of masks to john as a single command (in the way that hashcat allows).
The best you can do today is to use the custom placeholder syntax (-1, -2, etc.) just as you've done, and run each command separately (which could be combined into a single run with a batch or command file).
(And if your limitation on hashcat is ...
No, it is not possible to crack just any SHA-1 hash. Currently, there are two main issues with using the hash function for security purposes (not specifically password hashing):
It is a very fast hash, meaning a brute force attack will run much more quickly than it would if you were to correctly use a slow KDF. The fact that SHA-1 is fast does not allow you ...
crunch is a password generator that can do some of what you may be looking for.
crunch 8 8 -t ",@@@@@%%"
is a command that will generate a set of passwords that are exactly 8 characters long following the provided template:
, generates an upper case character
@ generates a lower case character
% generates a digit
You probably want to set various options ...
Sounds like a combinator attack would be a good place to start. It takes two input wordlists and tries all combinations of the two. In your case, the "left" list would be the beginning of your known password and the "right" list would be the unknown portions.
However, Hashcat only allows two input files to a combinator attack, but you can use the ...
When you look at the documentation, you are looking for the terms "character set" and "charset"
By default, the [Incremental:All] parameters are set to use the full
printable US-ASCII character set (95 characters)
The 95 characters do not include umlauts.
But later, the documentation reads:
If you've got a password file for which you already have a ...
You're not seeing them because they're invisible. :)
aad3b435b51404eeaad3b435b51404ee (LM) and 31d6cfe0d16ae931b73c59d7e0c089c0 (NTLM) correspond to an empty password.
This blog post explains in a little more detail, with command line examples to show how an empty password is hashed.
John the ripper logs its activity to stdout. If you note that it's cracked a password, you can terminate the session with a ctrl-C.
The log file .john/john.log will note the account(s) that have been cracked, with a timestamp. Grep that for 'Cracked' to turn those up.
Your Responder hash may be invalid, corrupt, or using an outdated format. Is it possible that you're using an older version of Responder, as noted in this question?
Showing my work:
Generally, the best way to validate your hashcat attack is correct for a specific hash type is to try your attack against an example hash from the hashcat wiki list of example ...
The jumbo version of john has a --list=format-details option. By default, it outputs one record per hash type for all hash types, with tab-separated values of a variety of information about that hash type (maximum password length, long name, etc.). You can also specify a hash type.
So for a specific hash type:
$ john --list=format-details --format=descrypt ...
Don't generate candidates external to the cracking tool if you can help it. Instead, let the cracking tool generate the candidates for you on-chip. This is much faster for faster hashes (but makes less of a difference for slow ones like bcrypt or WPA2).
If you have complex composition requirements, you can generate a list of masks instead (which can also ...
The logic of masks does not allow for this. If you want only a certain number of a certain character set in more than one position, then you have to permute the options yourself, either by what you have done or by creating a wordlist.
It is not possible to combine multiple hashes in order to speed up a brute-force attack. In your case the hashes seem to use the same algorithm, which means it doesn't matter which hash you try to crack.
John the Ripper is an open source password cracking tool. JTR's windows binaries by default support password cracking using wordlists and word-mangling first and then use the "incremental" mode which brute forces the hashes stored in the file if the wordlist method fails. However, JTR's pre-built versions support incremental mode up to 8 characters only. To ...
SHA1 is perhaps the worst scenario for securing passwords - except for plaintext storage or schemes without salt.
Password cracking tools not only test lists of passwords, but also replace individual letters, such as S with $, double letters, sample combinations of uppercase and lowercase letters for all passwords in the list, combine words, etc.
In the past when I've sharded password cracking across many machines, I have just split my wordlist into sections and provided each machine a section of wordlist to try. This seems much more straightforward than manipulating rules per entry in the wordlist. (After all, rules are meant to be applied to the wordlist, not to a single word.)
I actually spent a good deal of time looking into this when I got a little sidetracked one day. The NTLM suite of protocols is complicated. There are many versions out there and some have distinct weaknesses such as the one I discussed in this question a while back. This reference page provides a lot of technical details and code examples on how to build ...
Does it work when you try to encrypt and crack a PDF yourself?
Here is a rundown on encrypting and cracking it with the tools you described:
Get a sample PDF file sample.pdf.
Encrypt it. I'm using qpdf with the password abc123.
$ qpdf --encrypt abc123 abc123 256 -- sample.pdf sample_encrypted.pdf
Extract the hash.
$ ./pdf2john.pl pdf-sample_encrypted....
Incremental mode is not meant to be used with a wordlist. Incremental mode allows you to bruteforce a character space such as lowercase letters. For the example of the lowercase character space the bruteforce would start at one character, try all the combinations, move to two characters, and repeat until the password is cracked.