The whole idea is that a password which is sufficiently random (more correctly, a password which is generated from a sufficiently random process) will bring the probability of an attacker getting lucky sufficiently low to be neglected (if the attacker has only one chance in 14 millions to get the password within one week of computations, then you can even out the chances by buying a lottery ticket, which has one chance in 14 millions to make you rich enough to ignore those trivial matters of stolen passwords). For any given password, you can only reason on averages and pray for the best. The strength of a password is a property of how you generate it, not of the password itself. Or, said otherwise: no, John the Ripper is NOT the much fabled "password meter" which will give an absolute "strength value" to your password. Sometimes the attacker was faster sometimes he was slower. This means that if you generate one million such passwords, and each time get the attacker to crack the chosen password, and then sum up all the times taken and divide by one million, then you will find that average times. If your password is chosen "at random" (uniformly) in a set of N possible passwords, then the average attack time will be the time it takes to compute N/2 hashes (with whatever hash function is used in your specific situation). John the Ripper will use the provided word list, and then try "variants" of the said words, in some order which may or may not be representative of what an attacker will do.
The attacker will try a lot of passwords, and may be lucky. Open a Command Prompt and change into the directory where John the Ripper is located, then type: john -formatLM d:\hash.
Just download the Windows binaries of John the Ripper, and unzip it. The important thing to understand is that password cracking time is an average. John the Ripper is one of the most popular password cracking tools available that can run on Windows, Linux and Mac OS X.
0 kommentar(er)
