John the Ripper/Rules - Revision history

Admin: /* Passwords */

2016-03-29T12:32:43Z

Passwords

← Older revision		Revision as of 12:32, 29 March 2016
Line 301:		Line 301:
	400		400
	</pre>		</pre>

	~~=Passwords=~~

	~~Password re-use, password predictability: https://www.youtube.com/watch?v=MY3XWYr726I~~

	=Flags=		=Flags=

Admin: /* Passwords */

2016-03-29T12:13:32Z

Passwords

← Older revision		Revision as of 12:13, 29 March 2016
Line 304:		Line 304:
	=Passwords=		=Passwords=

	Password use, password predictability		Password re-use, password predictability: https://www.youtube.com/watch?v=MY3XWYr726I

	=Flags=		=Flags=

Admin: /* Pin Numbers */

2016-03-29T12:12:21Z

Pin Numbers

← Older revision		Revision as of 12:12, 29 March 2016
Line 301:		Line 301:
	400		400
	</pre>		</pre>

			=Passwords=

			Password use, password predictability

	=Flags=		=Flags=

Admin: /* Defining Rules */

2016-03-29T11:31:37Z

Defining Rules

← Older revision		Revision as of 11:31, 29 March 2016
Line 120:		Line 120:
	==Defining Rules==		==Defining Rules==

	First, start by defining some rule names:		First, start by defining some rule names.

	~~<pre>~~
	~~[List~~.~~Rules:AllPins]~~
	~~</pre>~~

	Some 4-digit numbers that are low-hanging fruit and hard to program with patterns:		Some 4-digit numbers that are low-hanging fruit and hard to program with patterns:

	<pre>		<pre>
			[List.Rules:CommonPins]
	# low hanging fruit		# low hanging fruit
			-[c:] \p[c:] Az"0123" <+
	-[c:] \p[c:] Az"1234" <+		-[c:] \p[c:] Az"1234" <+
	-[c:] \p[c:] Az"2345" <+		-[c:] \p[c:] Az"2345" <+
Line 148:		Line 146:
	-[c:] \p[c:] Az"2468" <+		-[c:] \p[c:] Az"2468" <+
	-[c:] \p[c:] Az"1357" <+		-[c:] \p[c:] Az"1357" <+
	~~-[c:] \p[c:] Az"0123" <+~~
	~~</pre>~~

	~~Create a pattern for numbers like 0000, 1111, etc.~~

	~~<pre>~~
	# xxxx		# xxxx
	-[c:] \p[c:] Az"0000" <+		-[c:] \p[c:] Az"0000" <+
Line 167:		Line 159:
	</pre>		</pre>

	Create ~~a pattern~~ for ~~numbers like 000X. The suffix <code>s12</code> means search for "1"s and replace them with "2"s.~~		Create some patterns for one-number PINs:

	<pre>		<pre>
			[List.Rules:OneNumberPins]
	# 000x		# 000x
	-[c:] \p[c:] Az"0001" <+		-[c:] \p[c:] Az"0001" <+
Line 180:		Line 173:
	-[c:] \p[c:] Az"0001"s18 <+		-[c:] \p[c:] Az"0001"s18 <+
	-[c:] \p[c:] Az"0001"s19 <+		-[c:] \p[c:] Az"0001"s19 <+
	~~</pre>~~

	~~The conjugate of that is, numbers like X000:~~

	~~<pre>~~
	# x000		# x000
	-[c:] \p[c:] Az"1000" <+		-[c:] \p[c:] Az"1000" <+
Line 197:		Line 185:
	</pre>		</pre>

	~~Create a pattern for numbers like X001~~. ~~2001 is a popular PIN, but some of the others are easy to remember, too:~~		Next comes two-number PIN patterns.

	<pre>		<pre>
			[List.Rules:TwoNumberPins]
	# x001		# x001
	-[c:] \p[c:] Az"1001" <+		-[c:] \p[c:] Az"1001" <+
Line 210:		Line 199:
	-[c:] \p[c:] Az"2001"s28 <+		-[c:] \p[c:] Az"2001"s28 <+
	-[c:] \p[c:] Az"2001"s29 <+		-[c:] \p[c:] Az"2001"s29 <+
	~~</pre>~~

	~~Look for patterns like XYXY, but where the numbers are close to each other: 1212, or 2323, or 3434, etc.~~

	~~<pre>~~
	# xyxy where x and y are within 1 of each other		# xyxy where x and y are within 1 of each other
	-[c:] \p[c:] Az"XYXY"sX1sY2 <+		-[c:] \p[c:] Az"XYXY"sX1sY2 <+
Line 224:		Line 208:
	-[c:] \p[c:] Az"XYXY"sX7sY8 <+		-[c:] \p[c:] Az"XYXY"sX7sY8 <+
	-[c:] \p[c:] Az"XYXY"sX8sY9 <+		-[c:] \p[c:] Az"XYXY"sX8sY9 <+
	~~</pre>~~

	~~And the same thing in reverse:~~

	~~<pre>~~
	# yxyx		# yxyx
	-[c:] \p[c:] Az"XYXY"sY1sX2 <+		-[c:] \p[c:] Az"XYXY"sY1sX2 <+
Line 240:		Line 219:
	</pre>		</pre>

	~~Cover combinations~~ of ~~months and~~ dates~~, since these are also popular~~:		The next set of PINs are for dates of the form MMYY:

	<pre>		<pre>
			[List.Rules:DatePins]
	# MMDD		# MMDD
	-[c:] \p[c:] Az"0[1-9][0-2][1-9]" <+		-[c:] \p[c:] Az"0[1-9][0-2][0-9]" <+
	-[c:] \p[c:] Az"0[1-9]3[0-1]" <+		-[c:] \p[c:] Az"0[1-9]3[0-1]" <+
	-[c:] \p[c:] Az"1[0-2][0-2][1-9]" <+		-[c:] \p[c:] Az"1[0-2][0-2][0-9]" <+
	-[c:] \p[c:] Az"1[0-2]3[0-1]" <+		-[c:] \p[c:] Az"1[0-2]3[0-1]" <+
	~~</pre>~~

	~~Plug up the pipeline with all the years, 1900-2000~~.		[List.Rules:YearPins]

	~~<pre>~~
	# 19xx		# 19xx
	-[c:] \p[c:] Az"19[0-9][0-9]" <+		-[c:] \p[c:] Az"19[0-9][0-9]" <+
Line 258:		Line 235:
	-[c:] \p[c:] Az"20[0-1][0-9]" <+		-[c:] \p[c:] Az"20[0-1][0-9]" <+
	-[c:] \p[c:] Az"20[2-9][0-9]" <+		-[c:] \p[c:] Az"20[2-9][0-9]" <+
			</pre>

			Top it all off by defining a master rule:

			<pre>
			# all pins
			[List.Rules:AllPins]
			.include [List.Rules:CommonPins]
			.include [List.Rules:OneNumberPins]
			.include [List.Rules:TwoNumberPins]
			.include [List.Rules:DatePins]
			.include [List.Rules:YearPins]
	</pre>		</pre>

Admin: /* Blow It Up */

2016-03-29T11:29:32Z

Blow It Up

← Older revision		Revision as of 11:29, 29 March 2016
Line 285:		Line 285:

	If we were checking a password file like <code>phpbb.txt</code>, which has 184,300 passwords, that would cost us 1,240 new passwords per password in the file (to check each password with a 4-digit number appended to it). That's 228,532,000 passwords total. At a rate of about 1,240 passwords per second, that would be 51, hours or 2.1 days. On a higher-end machine, you might get 1800 passwords per second, which cuts the time to 35 hours, or 1.4 days. Still a loooong time.		If we were checking a password file like <code>phpbb.txt</code>, which has 184,300 passwords, that would cost us 1,240 new passwords per password in the file (to check each password with a 4-digit number appended to it). That's 228,532,000 passwords total. At a rate of about 1,240 passwords per second, that would be 51, hours or 2.1 days. On a higher-end machine, you might get 1800 passwords per second, which cuts the time to 35 hours, or 1.4 days. Still a loooong time.

			===Breakdown===

			Note that each of these are tested with a single password as an input, but the number out is TWICE the number it should be, because John the Ripper is trying both uppercase and lowercase passwords.

			<pre>
			root@morpheus:~/box/besside# john --wordlist=one.txt --rules=CommonPins --stdout \| wc -l
			Press 'q' or Ctrl-C to abort, almost any other key for status
			58p 0:00:00:00 100.00% (2016-03-29 04:25) 414.2p/s one9999
			58
			root@morpheus:~/box/besside# john --wordlist=one.txt --rules=OneNumberPins --stdout \| wc -l
			Press 'q' or Ctrl-C to abort, almost any other key for status
			36p 0:00:00:00 100.00% (2016-03-29 04:25) 257.1p/s one9000
			36
			root@morpheus:~/box/besside# john --wordlist=one.txt --rules=TwoNumberPins --stdout \| wc -l
			Press 'q' or Ctrl-C to abort, almost any other key for status
			50p 0:00:00:00 100.00% (2016-03-29 04:25) 384.6p/s one9898
			50
			root@morpheus:~/box/besside# john --wordlist=one.txt --rules=DatePins --stdout \| wc -l
			Press 'q' or Ctrl-C to abort, almost any other key for status
			696p 0:00:00:00 100.00% (2016-03-29 04:26) 4640p/s one1231
			696
			root@morpheus:~/box/besside# john --wordlist=one.txt --rules=YearPins --stdout \| wc -l
			Press 'q' or Ctrl-C to abort, almost any other key for status
			400p 0:00:00:00 100.00% (2016-03-29 04:26) 2666p/s one2099
			400
			</pre>

	=Flags=		=Flags=

Admin: /* Defining Rules */

2016-03-29T11:20:40Z

Defining Rules

← Older revision		Revision as of 11:20, 29 March 2016
Line 123:		Line 123:

	<pre>		<pre>
	[List.Rules:~~Pins~~]		[List.Rules:AllPins]
	</pre>		</pre>

Line 130:		Line 130:
	<pre>		<pre>
	# low hanging fruit		# low hanging fruit
			-[c:] \p[c:] Az"1234" <+
			-[c:] \p[c:] Az"2345" <+
			-[c:] \p[c:] Az"3456" <+
			-[c:] \p[c:] Az"4567" <+
			-[c:] \p[c:] Az"5678" <+
			-[c:] \p[c:] Az"6789" <+
			-[c:] \p[c:] Az"7890" <+
	-[c:] \p[c:] Az"1004" <+		-[c:] \p[c:] Az"1004" <+
	-[c:] \p[c:] Az"4321" <+		-[c:] \p[c:] Az"4321" <+
Line 142:		Line 149:
	-[c:] \p[c:] Az"1357" <+		-[c:] \p[c:] Az"1357" <+
	-[c:] \p[c:] Az"0123" <+		-[c:] \p[c:] Az"0123" <+
	~~-[c:] \p[c:] Az"1234" <+~~
	~~-[c:] \p[c:] Az"2345" <+~~
	~~-[c:] \p[c:] Az"3456" <+~~
	~~-[c:] \p[c:] Az"4567" <+~~
	~~-[c:] \p[c:] Az"5678" <+~~
	~~-[c:] \p[c:] Az"6789" <+~~
	~~-[c:] \p[c:] Az"7890" <+~~
	</pre>		</pre>

Admin: /* Blow It Up */

2016-03-29T11:18:45Z

Blow It Up

← Older revision		Revision as of 11:18, 29 March 2016
Line 283:		Line 283:
	root@morpheus:~/box/besside#		root@morpheus:~/box/besside#
	</pre>		</pre>

			If we were checking a password file like <code>phpbb.txt</code>, which has 184,300 passwords, that would cost us 1,240 new passwords per password in the file (to check each password with a 4-digit number appended to it). That's 228,532,000 passwords total. At a rate of about 1,240 passwords per second, that would be 51, hours or 2.1 days. On a higher-end machine, you might get 1800 passwords per second, which cuts the time to 35 hours, or 1.4 days. Still a loooong time.

	=Flags=		=Flags=

Admin: /* Blow It Up */

2016-03-29T11:06:46Z

Blow It Up

← Older revision		Revision as of 11:06, 29 March 2016
Line 264:		Line 264:
	Check it:		Check it:

	1 password will become 1,240 passwords.		1 password will become 1,240 passwords. Better than 10,000!

	<pre>		<pre>

Admin: /* Blow It Up */

2016-03-29T11:04:24Z

Blow It Up

← Older revision		Revision as of 11:04, 29 March 2016
Line 262:		Line 262:
	==Blow It Up==		==Blow It Up==

	Check it. 92 passwords blows up to 114,080 passwords.		Check it:

			1 password will become 1,240 passwords.

			<pre>
			root@morpheus:~/box/besside# john --wordlist=one.txt --stdout \| wc -l
			1
			root@morpheus:~/box/besside# john --wordlist=one.txt --rules=Pins --stdout \| wc -l
			1240
			root@morpheus:~/box/besside#
			</pre>

			92 passwords blows up to 114,080 passwords.

	<pre>		<pre>
	root@morpheus:~/box/besside# john --wordlist=/root/codes/SecLists/Passwords/rockyou-10.txt --stdout \| wc -l		root@morpheus:~/box/besside# john --wordlist=/root/codes/SecLists/Passwords/rockyou-10.txt --stdout \| wc -l
	~~Press 'q' or Ctrl-C to abort, almost any other key for status~~
	~~92p 0:00:00:00 100.00% (2016-03-29 04:00) 613.3p/s junior~~
	92		92
	root@morpheus:~/box/besside# john --wordlist=/root/codes/SecLists/Passwords/rockyou-10.txt --rules=Pins --stdout \| wc -l		root@morpheus:~/box/besside# john --wordlist=/root/codes/SecLists/Passwords/rockyou-10.txt --rules=Pins --stdout \| wc -l
	~~Press 'q' or Ctrl-C to abort, almost any other key for status~~
	~~114080p 0:00:00:00 100.00% (2016-03-29 04:00) 671058p/s junior2099~~
	114080		114080
	root@morpheus:~/box/besside#		root@morpheus:~/box/besside#

Admin: /* Pin Numbers */

2016-03-29T11:02:43Z

Pin Numbers

@@ Line 117: / Line 117: @@
 I wanna turn this into some John the Ripper rules.
 First, start by defining some rule names:
@@ Line 256: / Line 258: @@
 -[c:] \p[c:] Az"20[0-1][0-9]" <+
 -[c:] \p[c:] Az"20[2-9][0-9]" <+
 </pre>