Posts

Analyzing Tokenizer Part 2: Omen + Tokenizer

By -
Image
  “I have not failed. I've just found 10,000 ways that won't work” -  Thomas Edison Introduction: This is a continuation of a deep dive into John the Ripper's new Tokenizer attack. Instruction on how to configure and run the original version of Tokenizer can be found [ Here ]. As a warning, those instructions need to be updated as a new version of Tokenizer has been released that makes it easier to configure. The first part of my analysis can be found [ Here ]. This is going to be a bit of a weird blog entry as this is a post about failure . Spoiler alert: If you are reading this post to learn how to crack passwords, just go ahead and skip it. My tests failed , my tools failed , and my understanding of my tools failed . A disappointing number of passwords were cracked in the creation of this write-up. I'll admit, I was very tempted to shelve this blog post. But I strongly believe that documenting failures is important. Often when reading blog posts you don't really...
Post a Comment
Read more

Analyzing JtR's Tokenizer Attack (Round 1)

By -
Image
Introduction / Goals / Scope: This is a follow-up to my previous blog post looking at how to install/run the new John the Ripper Tokenizer attack [ Link ]. The focus of this post will be on performing a first pass analysis about how the Tokenizer attack actually performs. Before I dive into the tests, I want to take a moment to describe the goals of this testing. My independent research schedule is largely driven by what brings me joy. Because of that I'm trying to get better at scoping efforts to something I can finish in a couple of days. It's easy to be interested in something for a couple of days! Therefore, my current plan is to run a couple of tests to get a high level view of how the Tokenizer attack performs and then see where things go.  To that end, this particular blog post will focus on three main "tests" to answer a couple of targeted questions. Test 1: Analyze how sensitive Tokenizer is to the size of the training data Question: How sensitive is the Toke...
Post a Comment
Read more

Running JtR's Tokenizer Attack

By -
Image
Disclaimer 1: This blog post is on a new and still under development toolset in John the Ripper. Results depict the state of the toolset as-is and may not reflect changes made as the toolset evolves. Disclaimer 2: I really need to run some actual tests and password cracking sessions using this attack, but I'm splitting that analysis up into a separate blog post. Basically I have enough forgotten drafts sitting in my blogger account that I didn't want to add another one by trying to "finish" this post before hitting publish. So stay tuned for new posts if you want to see how effective this attack really is. Introduction: It's been about 15 years since I last wrote about John the Ripper's Markov based Incremental mode attacks [ Link ] [ Link 2 ]. 15 years is a long time! A lot of work has been done applying Markov based attacks to password cracking sessions, ranging from the OMEN approach to Neural Network based password crackers. That's why I was so excite...
Post a Comment
Read more