Wordlist mode rulesets for use with John the Ripper

These are some rulesets that you may put into your john.conf file and invoke with –rules=NAME (specifying the section NAME) on the command-line (this option syntax requires the jumbo patch).

• KoreLogic's original rules as released right after the DEFCON 2010 contest. This file was downloaded from http://contest-2010.korelogic.com/rules.html and it was originally called simply rules.txt.
• A revision of the above combining all sections into a single KoreLogicRules section. This is only intended for testing, not for actual use, since the sections are combined in the order they were listed in the original rules.txt, which did not reflect an optimal order for their use. Additionally, different sections were intended for use with wordlists of different size.
• KoreLogic rules above reworked by Solar Designer to make better use of the preprocessor (the file became 3 times smaller, and the number of lines 10 times smaller), to produce fewer duplicates (especially with length-limited and/or case-insensitive hash types), to generate some kinds of candidate passwords that were inadvertently missed by KoreLogic (because of implementation bugs in the original rules.txt), and to avoid generating candidate passwords that were likely being generated unintentionally (again, because of bugs).
• A revision of the above combining all sections into a single KoreLogicRules section. Only intended for testing, for the reason mentioned above.
• A newer revision containing both the individual sections and all of them combined into a single KoreLogicRules section. In this revision, the individual sections have been included into the combined KoreLogicRules section roughly in the order of increasing number of candidate passwords generated by each of the former individual sections, thus making this combined section suitable for actual use. Also, the *CurrentYear* sections (and the corresponding lines of the combined KoreLogicRules section) have been updated to try years 2010 through 2019 (and not just 2010 alone) for the “current year”.

The rulesets above were announced/documented on john-users.

• A fixed version of the above last version. This is just the simple fix of the above rules by Kost (also available on GitHub)

The ruleset above was announced/documented on john-users.

Localized KoreLogic rules for Croatia - these are relevant rules localized for Croatia (also available on GitHub)

• Passwords^12 presentation
• Mangling rules optimized separately for slow vs. fast hashes (2012/12/19)

You'll need to remove the trailing ” NBPWD=…” from each line to use these rulesets.

• More year-based password cracking rules (2009/03/27)
• New john.conf rules (Part 2) (2009/04/24)
• Generation method and generated prepend and append rules JimF (2009/07/27)
• A serie of posts about another generation method (part 1, 2, 3, 4 and an update). The tool is here.
• m3g9tr0n's rules set 1 and set 2 as referenced in the Cracking Story – How I Cracked Over 122 Million SHA1 and MD5 Hashed Passwords blog post

Back to John the Ripper user community resources.