Most useful and currently relevant excerpts from john-users mailing list

• Cracking SMTP's AUTH CRAM-MD5 exchanges (2010/07/27)
• Cracking sniffed LM and NTLM challenge/response exchanges (2010/07/09)
• Bitslice DES parallelization with OpenMP for multi-salt crypt(3) (2010/06/30)
  • ...and for single-salt crypt(3) and LM hashes (2010/07/03)
• How to speed up JtR's DES code on Intel Atom CPUs (+10% with 32-bit build) (2010/06/28)
• Auditing SHA-crypt hashes with JtR 1.7.6+ on Linux (Ubuntu, Fedora, etc.) and on Solaris 10, including OpenMP parallelization (2010/06/20)
• OpenBSD-style Blowfish-based crypt(3) (bcrypt) cracking benchmarks on 8-way x86-64 systems (Core i7 and Dual quad-core Xeon) with OpenMP parallelization (2010/05/08)
• Replacement for all.chr based on "Rock You" passwords (2010/02/03)
  • ...and a follow-up (2010/02/05)
• Cracking Cisco ASA and new PIX salted password hashes (2010/02/02)
• Estimating password complexity (theory, advanced) (2009/12/07)
• Making "incremental" mode follow a password policy by an external filter() (2009/10/28)
  • ...with specific external filter() examples (2009/10/28)
  • ...also for another policy (2009/02/10)
• Pre-built JtR packages for Solaris (2009/09/27)
  • How to build (compile) JtR on Solaris (2008/04/24)
• Cracking Finnish passwords (2009/08/17)
• Cracking Windows LM/NTLM hashes; PWDUMP file format (2009/07/30)
• On the purpose and the effect of "incremental" mode's CharCount setting (2009/07/26)
  • Using CharCount to restrict JtR to trying fewer characters (2009/02/20)
• c/s rate explained (2009/07/25)
• Recovering passwords to something not supported by JtR directly (2009/07/10)
• Cracking Russian passwords (2009/07/09)
• Cracking Windows challenge/response authentication with Metasploit and JtR (2009/05/12)
• Cracking RACF passwords (not with JtR yet...) (2009/04/23)
• Cracking Windows password hash dumps obtained with Login Recovery's boot disks (2009/04/07)
• Modifying the DumbForce and KnownForce external modes for a specific password pattern (2009/03/26)
• Invalid salts with traditional DES-based crypt(3) (2009/02/28)
  • Invalid salts - more info on the two known mappings (2008/10/03)
• On wordlists larger than 2 GB requiring a 64-bit build of JtR (2009/02/19)
  • Mac OS X specific (2009/06/14)
  • On enhancing JtR to support Large Files on 32-bit (2008/12/09)
• bigcrypt vs. crypt16 (2009/02/15)
  • Links to sample bigcrypt and crypt16 hashes (2009/02/15)
• On many valid-looking 13-character strings not being accepted as valid DES-based crypt(3) hash encodings (2009/02/05)
• Advantages of JtR Pro and of the non-free Openwall wordlists (2009/01/10)
• Wordlist rules for leet speak (2008/10/03)
• Perl scripts to generate sample hashes (all supported Unix crypt(3), LM, NTLM) and files for testing of JtR (2008/06/18)
• What directories JtR searches for its configuration and data files; JtR "home directory"; system-wide installs (2008/06/16)
• Buying a new computer to run JtR on - what to choose, what performance to expect? (2008/06/08)
• Just how fast the "incremental" mode can be at generating candidate passwords (2008/06/02)
• Combining "incremental" mode with external filter() to crack a partially-known password (2008/05/20)
• Parallel processing, distributed processing (2008/04/08)
• KnownForce external mode - exhaustive search for a partially-known password (2008/03/31)
• What JtR is and what it is not; password recovery (2008/03/20)
• DumbForce external mode variations for 8-bit characters (2008/03/17)
  • A specific example for cracking French passwords (2009/07/26)
• How to make "incremental" mode try 8-bit characters (2008/03/17)
  • Related discussion around cracking French passwords (2009/07/25)
• Case-insensitive hashes, rules & charsets (2008/02/24)
• DumbForce external mode - dumb exhaustive search, given a range of lengths and an arbitrary charset (2008/02/24)
• UltraSPARC T1 and T2 (2008/01/29)
  • bcrypt with OpenMP parallelization (32 threads) benchmarks on UltraSPARC T2 (2010/05/16)
• NTLM hashes support not getting in - why not? (2008/01/27)
• Trivial external mode for exhaustive search over tiny custom charset and fixed length, less generic than DumbForce (2008/01/26)
• How to deal with different (multiple) hash types ("formats"); the need for "unshadow" and "--show" (2008/01/21)
• Cracking a 12 character long password (slow hash) (2007/11/11)
• CPUShare port of JtR MD5-based crypt(3) code (2007/09/18)
  • CPUShare port - additions (2007/11/12)
• How to make "incremental" mode work for lengths beyond 8 (2007/07/04)
• "Idle" setting: system responsiveness and performance (2007/06/05)
• Processing wordlists from the Openwall collection (2007/06/05)
• How to apply a contributed patch to JtR 1.7.2 (2007/04/07)
• Contributed patches not getting in - why not? (2007/03/19)
• Administrivia - list charter - what topics are desirable on john-users (2007/02/17)
• How to instantly crack NTLM hashes (case-sensitive) given cracked LM ones (2006/07/08)
• The "M" (memorize) and "Q" (query) rule commands explained, with examples (2006/06/28)
• Comments on possibly adding parallel processing support with OpenMP (2006/05/23)
• Cracking Cisco IOS "type 5" passwords (2006/05/14)
• Support for 8-bit characters (e.g., for languages other than English) (2006/02/16)
• Some estimates (math) on dumb exhaustive searches (2006/02/07)
• JtR internals - optimizations related to key setup and salt setup "overhead" (2006/01/19)
• Cracking application (non-OS) passwords (2006/01/09)
• Remote password cracking (2006/01/09)
  • Remote password cracking - addition (2006/01/13)
• What salts are (2005/12/18)
• SAP R/3 password security (CODVN A, B, D) - initial posting (2005/12/11)
  • SAP R/3 password security - more detail (2005/12/13)
  • SAP R/3 password cracking implemented for JtR (now part of the jumbo patches) (2008/06/26)
• Script to extract password hashes from a CommuniGate Pro messaging server for use with JtR (2005/11/22)
• JtR internals - "the right way" to implement parallel processing with "incremental" mode (not by an end-user) (2005/11/21)
• JtR internals - hashes might be never fully computed/encoded (2005/11/11)
• Comments on special-purpose crypto accelerator chips/cards (2005/10/13)
• Understanding benchmark results - c/s rate vs. Mbps of underlying cipher (2005/09/18)
• Trivial parallel processing (4 CPUs or CPU cores) (2005/08/24)
  • Trivial parallel processing - also for wordlist mode (2005/08/26)
• Password policy enforcement (2005/08/15)
• Understanding different hash types in use on Unix-like systems (2005/07/02)

Back to John the Ripper user community resources.