2

Does the result output line of john the ripper show all the words tried?

E.g. does this line

0g 0:00:00:08 DONE (2022-03-11 06:00) 0g/s 1665Kp/s 1665Kc/s 1665KC/s 99CS .. 9999

mean that john tried all the words in the range between 99CS and 9999? Or what should I read from this?

Background is that I have generated a wordlist with a range from aaaa to 9999 (and some modifications inbetween, that's why normal bruteforcing won't work) and then called john like this

john --wordlist='wordlist.txt' --format=HMAC-SHA256 jwt.txt

and I would have expected the output to show as

0g 0:00:00:08 DONE (2022-03-11 06:00) 0g/s 1665Kp/s 1665Kc/s 1665KC/s aaaa .. 9999

Complete output (typed, not copied, so there might be errors)

Using default input encoding: UTF-8 
Loaded 1 password hash (HMAC-SHA256 [password is key, SHA256 128/128 SSE2 4x]) 
Will run 4 OpenMP threads 
Press 'q' or Ctrl-C to abort, almost any other key for status 
0g 0:00:00:08 DONE (2022-03-11 06:00) 0g/s 1665Kp/s 1665Kc/s 1665KC/s 99CS .. 9999 
Sessions completed.

I noticed that when I do a longer cracking and press Enter in between (to show the current progress) I get a different list shown here:

Using default input encoding: UTF-8 
Loaded 1 password hash (HMAC-SHA256 [password is key, SHA256 128/128 SSE2 4x]) 
Will run 4 OpenMP threads 
Press 'q' or Ctrl-C to abort, almost any other key for status 
0g 0:00:09:18 95,89% (ETA 09:27:46) 0g/s 1582Kp/s 1582Kc/s 1582KC/s 7Cbi8 .. 7Ccnb 
0g 0:00:09:38 DONE (2022-03-11 09:27) 0g/s 1582Kp/s 1582Kc/s 1582KC/s 999Ua .. 99999 
Sessions completed.
schroeder
  • 123,438
  • 55
  • 284
  • 319
Bat
  • 21
  • 4
  • So, you have answered your own question then? – schroeder Mar 11 '22 at 10:46
  • Well, not entirely sure. I now know that I can draw nothing from that line, just probably that this was the last "batch" that was executed... – Bat Mar 11 '22 at 13:05

1 Answers1

0

Although I am unhappy with the solution, it seems to be this:

This part of the output seems to display the last batch of passwords tried. Probably the ones tried in the last second (as one batch seems to last one second - indicated by the metrics being per second).

Bat
  • 21
  • 4