#

# This file is part of John the Ripper password cracker,

# Copyright (c) 1996-2006,2008-2013,2019 by Solar Designer

#

# Redistribution and use in source and binary forms, with or without

# modification, are permitted.

#

# There's ABSOLUTELY NO WARRANTY, express or implied.

#

# Please note that although this configuration file is under the cut-down BSD

# license above, many source files in John the Ripper are under GPLv2.

# For licensing terms for John the Ripper as a whole, see doc/LICENSE.

#

# ...with changes in the jumbo patch, by various authors

#

# The [Options] section is for general options only.

# Note that MPI specific options have been moved

# to [Options.MPI]

# There is also a new section [Options.OpenCL]

# for OpenCL specific options

# Default settings for Markov mode have been moved

# to [Markov.Default], but you can define other

# Markov modes as well, see ../doc/MARKOV

[Options]

# Default wordlist file name (including in batch mode)

Wordlist = $JOHN/password.lst

# Use idle cycles only

Idle = Y

# Crash recovery file saving delay in seconds

Save = 60

# Beep when a password is found (who needs this anyway?)

Beep = N

# if set to Y then dynamic format will always work with bare hashes. Normally

# dynamic only uses bare hashes if a single dynamic type is selected with

# the -format= (so -format=dynamic_0 would use valid bare hashes).

DynamicAlwaysUseBareHashes = N

# Default Single mode rules

SingleRules = Single

# Default batch mode Wordlist rules

BatchModeWordlistRules = Wordlist

# Default wordlist mode rules when not in batch mode (if any). If this is

# changed from an 'empty list' to have default rules applied, and you later

# DO want to perform a run once without rules, use --rules:none on the

# command line. The default is 'empty' or NO rules run at all.

WordlistRules =

# Default loopback mode rules (if any)

# If this is set and you want to run once without rules, use --rules:none

LoopbackRules = Loopback

# Max. number of times to warn about crypting suboptimally small batches,

# before suppressing the warnings.

MaxKPCWarnings = 10

# If set to true, relax the KPC warning checks and only warn for really

# bad situations (the fewer salts, the more slack).

RelaxKPCWarningCheck = N

# Default/batch mode Incremental mode

# Warning: changing these might currently break resume on existing sessions

# one option frequently changed (with above caveat) is setting DefaultIncrementalUTF8 = UTF8

DefaultIncremental = ASCII

DefaultIncrementalUTF8 = ASCII

DefaultIncrementalLM = LM_ASCII

# Time formatting string used in status ETA.

#

# TimeFormat24 is used when ETA is within 24h, so it is possible to omit

# the date then if you like, and show seconds instead.

#

# %c means 'local' specific canonical form, such as:

# 05/06/11 18:10:34

#

# Other examples

# %d/%m/%y %H:%M (day/mon/year hour:min)

# %m/%d/%y %H:%M (mon/day/year hour:min)

# %Y-%m-%d %H:%M (ISO 8601 style, 2011-05-06 18:10)

TimeFormat = %Y-%m-%d %H:%M

TimeFormat24 = %H:%M:%S

#

# optional add a date timestamp in front of every logged line.

# the default is no timestamp logging. See the docs for

# strftime for more information:

# http://en.cppreference.com/w/c/chrono/strftime

#

# examples:

# 2016-02-20T22:35:38+01:00 would be %Y-%m-%dT%H:%M:%S%z

# Feb 20 22:35:38 would be %b %d %H:%M:%S

LogDateFormat =

# if log date is being used, the time will default to local

# time. But if the next line is changed to 'Y', date output

# in UTC. Note, if LogDateFormat is not set, this option

# is ignored.

LogDateFormatUTC = N

# if logging to stderr (--log-stderr command line switch used),

# then use date format when outputting to the stderr.

#

# example

# Feb 20 22:35:38 would be %b %d %H:%M:%S

LogDateStderrFormat =

# If this is given, it will be printed in the end on any cracked password

# output. In case some 8-bit passwords upset your terminal, putting an

# ANSI "SGR Reset/Normal" here might be a cure. Any "^" characters will be

# parsed as ESC for use in ANSI codes (like in the default)

TerminalReset = ^[0m

# This can be used to colorize (on screen) or otherwise emphasize (in log

# files) output whenever a supposed administrator password gets cracked.

#

# Set this to N or comment it out to disable all "MarkAdmin" stuff.

MarkAdminCracks = Y

# If MarkAdminCracks = Y above, the below will be used (if defined) for

# terminal output. The default is to change color to red before the username

# and reset to normal after it. Any "^" characters will be parsed as ESC for

# use in ANSI codes (like in the defaults)

MarkAdminStart = ^[31m

MarkAdminEnd = ^[0m

# If MarkAdminCracks = Y above, the below will be used (if defined) for logs.

# This literal string will be printed after the " + Cracked: root" line.

MarkAdminString = (ADMIN ACCOUNT)

# Permissions to set for session.log file

# Default is 0600

LogFilePermissions = 0600

# Permissions to set for POT file

# Default is 0600

PotFilePermissions = 0600

# John exits if another user owns log or pot file because CHMOD fails,

# If this is set John prints a warning and continues

# Default is N

IgnoreChmodErrors = N

# This figure is in MB. The default is to memory map wordlists not larger

# than one terabyte.

# Set this to 0 to disable any use of memory-mapping in wordlist mode.

WordlistMemoryMapMaxSize = 1048576

# For single mode, load the full GECOS field (before splitting) as one

# additional candidate. Normal behavior is to only load individual words

# from that field. Enabling this can help when this field contains email

# addresses or other strings that are better used unsplit, but it increases

# the number of words tried so it may also slow things down.

PristineGecos = N

# Add an extra pass when loading Single words, that tries to parse things

# like JEdgarHoover to J Edgar Hoover and so on.

JumboSingleWords = N

# For single mode, ignore the login field.

# Normal behavior is to use the login field for single mode.

# Skipping the login field should only be enabled if previous single mode

# sessions did already make use of the login field, but no other information,

# and now you want to use other information, skip the login field, but still

# want the login field to be reported on successful cracks or with --show.

SingleSkipLogin = N

# Over-ride SINGLE_WORDS_PAIR_MAX in params.h. This may slow down Single mode

# but it may also help cracking a few more candidates. Default in core John

# is 4 while the Jumbo default is 6. This limit is automagically increased

# by word seed options --single-seed and/or --single-wordlist if needed.

SingleWordsPairMax = 6

# Setting this to false stops Single mode from re-testing guessed plaintexts

# with all other salts.

SingleRetestGuessed = Y

# Max recursion depth for SingleRetestGuessed, so we don't blow the stack

SingleMaxRecursionDepth = 10000

# Set the maximum word buffer size used by Single mode. The default is

# 4 GB. If running fork this is the *total* used by a session (size is

# divided by number of forks). If running MPI, we try to determine the

# number of local processes on each node and divide it accordingly.

SingleMaxBufferSize = 4

# When running single mode with a GPU or accelerator, we prioritize speed

# (saturating buffers) over resume ability: When resuming such a session

# it may take longer to catch up. Set this option to Y to prioritize

# resuming instead, at the cost of max. speed.

SinglePrioResume = N

# Protect the restore files (*.rec) from being overwritten. The default

# mode is "Disabled". This mode will provide no protection, but has been

# the default mode in JtR forever, so to not change behavior, that mode

# has been kept as default. You can change this to "Named" or "Always"

# If this option is changed to "Named", then any restore file created

# with a --session=xxxx will be protected from being overwritten. If

# the option is set to "Always", then all .rec files will be kept from

# being overwritten, even ${JOHN}/john.rec file

SessionFileProtect = Disabled

# Protect the log files (*.log) from being reused by new sessons.

# The default mode is "Disabled". That means, a nee session will just append

# to an existing log file.

# With "Named", a new session will not be allowed to append to an existing

# log file, except if the --session=NAME option hasn't been used.

# With "Always", not even the default log file ${JOHN}/john.log can be

# reused by a new session.

# (Of course, a restored session will always be allowed to append to an

# existing log file.)

# Unless you use the --nolog option, setting LogFileProtect will also

# prevent overwriting existing session files.

LogFileProtect = Disabled

# Emit a status line whenever a password is cracked (this is the same as

# passing the --crack-status option flag to john). NOTE: if this is set

# to true here, --crack-status will toggle it back to false.

CrackStatus = N

# When printing status, show number of candidates tried (eg. 123456p).

# This is added to the "+ Cracked" line in the log as well (and that figure

# will be exact while the screen output will be a multiple of batch size).

StatusShowCandidates = N

# Write cracked passwords to the log file (default is just the user name)

LogCrackedPasswords = N

# Disable the dupe checking when loading hashes. For testing purposes only!

NoLoaderDupeCheck = N

# Default encoding for input files (ie. login/GECOS fields) and wordlists

# etc. If this is not set here and --encoding is not used either, the default

# is ISO-8859-1 for Unicode conversions and 7-bit ASCII encoding is assumed

# for rules, e.g., uppercasing of letters other than a-z will not work at all!

DefaultEncoding = UTF-8

# Default --target-encoding for Microsoft hashes (LM, NETLM et al) when input

# encoding is UTF-8. CP850 would be a universal choice for covering most

# "Latin-1" countries.

DefaultMSCodepage = CP850

# Default internal legacy codepage to be used by mask mode and within the

# rules engine, when both input and target encodings are Unicode (eg. UTF-8

# wordlist and NT hashes). In some cases this hits performance but lets us

# do things like Unicode case conversions. You can pick any supported

# legacy codepage that has as much support for the input data as possible,

# e.g., for "Latin-1" language passwords you can use ISO-8859-1, CP850 or

# CP1252 and it will hardly make any difference but in some cases, ISO-8859-1

# is fastest. Using "UTF-8" (which is not a legacy codepage!) will disable.

#

# The default is to NOT use any internal codepage.

DefaultInternalCodepage =

# Warn if seeing UTF-8 when expecting some other encoding, or vice versa.

# This is disabled for ASCII or RAW encodings, for performance.

WarnEncoding = Y

# Always report (to screen and log) cracked passwords as UTF-8, regardless of

# input encoding. This is recommended if you have your terminal set for UTF-8.

AlwaysReportUTF8 = Y

# Always store Unicode (UTF-16) passwords as UTF-8 in john.pot, regardless

# of input encoding. This prevents john.pot from being filled with mixed

# and eventually unknown encodings. This is recommended if you have your

# terminal set for UTF-8 and/or you want to run --loopback for LM->NT

# including non-ASCII.

UnicodeStoreUTF8 = Y

# Always report/store non-Unicode formats as UTF-8, regardless of input

# encoding. Note: The actual codepage that was used is not stored anywhere

# except in the log file.

# This is needed e.g. for --loopback to crack LM->NT including non-ASCII.

CPstoreUTF8 = Y

# Normally, we try to handle Unicode characters not in our selected codepage

# with best effort. Enabling this option will instead translate any such

# character to "?" (default), to meet certain formats' behavior.

EmulateBrokenEncoding = N

ReplacementCharacter = ?

# Default verbosity is 3, valid figures are 1-5 right now.

# 4-5 enables some extra output and diagnostics.

# 4 is same verbosity as "john proper" aka. non-jumbo.

# 3 mutes rules & incremental output in logs (LOTS of lines).

# 2 mutes some other diagnostics.

# 1 even mutes printing (to screen) of cracked passwords.

Verbosity = 3

# If set to Y, do not output, log or store cracked passwords verbatim.

# This implies a different default .pot database file "secure.pot" instead

# of "john.pot" but it can still be overridden using --pot=FILE.

# This also overrides other options, e.g. LogCrackedPasswords.

SecureMode = N

# If set to Y, a session using --fork or MPI will signal to other nodes when

# it has written cracks to the pot file, so they will re-sync. Note that this

# may be delayed by buffers and the "Save" timer setting near top of this file.

ReloadAtCrack = N

# If set to Y, a session using --fork or MPI will signal to other nodes when

# it has cracked all hashes (there's nothing more to do!). This is ignored

# when ReloadAtCrack = Y because it's redundant.

ReloadAtDone = Y

# If set to Y, resync pot file when saving session. This does not involve any

# signalling, we just detect that someone else wrote to the pot file.

# This will sync with concurrent sessions even when not using --fork or MPI

# but it may be delayed by the "Save" timer setting near top of this file.

ReloadAtSave = Y

# If this file exists, john will abort cleanly

AbortFile = /var/run/john/abort

# While this file exists, john will pause

PauseFile = /var/run/john/pause

# If set to true, the uid will be appended to user name on cracks

# With: password123 (Administrator:500)

# Without password123 (Administrator)

# This is disabled by --save-memory.

ShowUIDinCracks = N

# This sets the "grace time" for --max-run-time=N. If john has not finished

# this long after the initial abort signal, it will send another one (similar

# to pressing ctrl-c a second time) which will stop john immediately and not

# wait further for an optimal resume point.

# Setting this to 0 means NO grace time - immediately abort. Setting it to

# a negative number means UNLIMITED grace time - never hard abort.

AbortGraceTime = 30

# Setting this to true allows SAP-B and SAP-G "half hashes" to be cracked.

# These are taken from RFC_READ_TABLE and padded with nulls to correct length.

# This may produce some false positives if enabled, at least for SAP-B.

SAPhalfHashes = N

[Options:CPUtune]

# If preset is given, use it and skip autotune (NOTE: non-intel archs will

# currently ignore this option and always autotune)

UsePreset = Y

# Performance sample time, default 10 ms

AutoTuneSampleTime = 10

# Required gain to consider this scale better. Default is 1 %

AutoTuneReqGain = 1

# Max crypt_all() duration for trying a higher scale, default 100 ms

AutoTuneMaxDuration = 100

# If we tried this many increases of scale w/o gain, give up. Default 3.

AutoTuneMaxNoProgress = 3

[Options:MPI]

# Automagically disable OMP if MPI is used (set to N if

# you want to run one MPI process per multi-core host)

MPIOMPmutex = Y

# Print a notice if disabling OMP (when MPIOMPmutex = Y)

# or when running OMP and MPI at the same time

MPIOMPverbose = Y

# Assume all MPI nodes are homogenous; Enforce same OpenCL workgroup sizes.

MPIAllGPUsSame = N

# Options that may affect both GPUs and other accelerators (eg. FPGA)

[Options:GPU]

# Show GPU temperature, fan and utilization along with normal status output

SensorsStatus = Y

# If SensorsStatus is true, individual ones can be turned off

TempStatus = Y

UtilStatus = N

FanStatus = N

# Abort the process or sleep for a while if a GPU hits this temperature (in C)

AbortTemperature = 95

# Instead of aborting, sleep for this many seconds to cool the GPU down when

# the temperature hits the AbortTemperature value, then re-test the temperature

# and either wake up or go to sleep again. Set this to 0 to actually abort.

# Suppress repeated sleep/wakeup messages when SleepOnTemperature = 1, which we

# interpret as intent to keep the GPU temperature around the limit.

SleepOnTemperature = 1

[Options:OpenCL]

# Set default OpenCL device(s). Command line option will override this.

# If not set, we will search for a GPU or fall-back to the most

# powerful device. Syntax is same as --device option.

Device =

# If set to true, store LWS and GWS in session file for later resume.

# Note that when resuming, this option is ignored: If the session file

# was written with this option set, it will still be used.

ResumeWS = N

# Global max. single kernel invocation duration, in ms. Setting this low

# (eg. 10-100 ms) gives you a better responding desktop but lower performance.

# Setting it high (eg. 200-500 ms) will maximize performance but your desktop

# may lag. Really high values may trip watchdogs (eg. 5 seconds). Some versions

# of AMD Catalyst may hang if you go above 200 ms, and in general any good

# kernel will perform optimally at 100-200 ms anyway.

Global_MaxDuration =

# Some formats vectorize their kernels in case the device says it's a good

# idea. Some devices give "improper" hints which means we vectorize but get

# a performance drop. If you have such a device, uncommenting the below

# will disable vectorizing globally.

# With this set to N (or commented out) you can force it per session with

# the --force-scalar command-line option instead.

ForceScalar = N

# Global build options. Format-specific build options below may be

# concatenated to this.

GlobalBuildOpts = -cl-mad-enable

# Initial local work-size for auto-tune (CPU devices excepted).

# 0 means let the OpenCL implementation pick a suitable value.

# 1 means query for "best multiple" (usually corresponds to "warp size").

# Any other value (eg. 64) will be taken verbatim.

AutotuneLWS = 1

# Format-specific settings:

# Uncomment the below for nvidia sm_30 and beyond.

# Please, check if it is really better.

#sha512crypt_BuildOpts = -cl-nv-maxrregcount=80

# Best configuration value to be used at runtime.

sha512crypt_Bonaire = -DUNROLL_LOOP=132104

# Example: Override auto-tune for RAR format.

#rar_LWS = 128

#rar_GWS = 8192

[List.OpenCL:Drivers]

#Driver ; Description ; Recommendation

#AMD driver versions

938 , 2 ; 12.8 ;

1084, 4 ; 13.1 ;

1124, 2 ; 13.4 ;

1214, 3 ; 13.6 beta ;

1311, 2 ; 13.11 beta-1 ;

1348, 5 ; 13.12 ;

1445, 5 ; 14.4 (Mantle) ;

1526, 3 ; 14.6 beta (Mantle) ;

1573, 4 ; 14.9 (Mantle) ; VGL S

1642, 5 ; 14.12 (Omega) ; VGL S

1702, 3 ; 15.5 beta ; T

1729, 3 ; 15.5 ;

1800, 5 ; 15.7 ; VG* R

1800, 8 ; 15.7.1 ; VGW R

1800, 11; 15.9 ; VGL S

1912, 5 ; 15.12 ;

#NVIDIA driver versions

346, 0 ; ; N* R

319, 0 ; ; N* S

#End

0, 0 ; ;

#Labels

# * -> all OS

# N -> NVIDIA

# G -> GCN

# V -> VLIW4 and VLIW5

# W -> Windows

# L -> Linux

# R -> recommended

# S -> supported

# T -> not recommended: really bad software. I mean "trash".

# ZTEX specific settings

[List.ZTEX:Devices]

# If you list Serial Numbers (SN) of ZTEX boards here, it will display

# numbers (starting from 1) instead of factory programmed SN's.

# These numbers can be used in --dev command-line option.

#04A36E0000

#04A36D0000

[ZTEX:descrypt]

# The design has programmable clock. Design tools reported possible

# frequency to be 221 MHz. Tested boards work reliably at 190.

Frequency = 190

[ZTEX:bcrypt]

# Define typical setting of hashes it's going to process. It allows

# to adjust for best performance.

TargetSetting = 5

# Design tools reported possible frequency to be 141.5 MHz.

# Tested boards work reliably at 150, so that's what we use by default.

Frequency = 150

# For any algorithm it's possible to set frequency on per-board and

# per-FPGA basis, but the lowest frequency will determine performance.

#Frequency_04A36E0FD6 = 142

#Frequency_04A36E0FD6_1 = 143

#Frequency_04A36E0FD6_4 = 144

[ZTEX:sha512crypt]

#TargetRounds = 5000

# Design tools reported possible frequency to be 215 MHz.

# We never encountered a board where this worked anywhere close

# to such high frequency. Default frequency is set to 160 MHz.

# Some lucky boards might run at some higher frequency.

Frequency = 160

#Config1 = \x00\x00

[ZTEX:Drupal7]

#TargetRounds = 16384

# Drupal7 uses same bitstream as sha512crypt, see comment regarding

# default frequency in sha512crypt section.

#Frequency = 160

# Some bitstreams accept runtime configuration.

# In sha512crypt/Drupal7, configuration is 2 bytes. That's interpreted

# as a bitmask. By setting any of the lowest 10 bits to 1 it turns off

# corresponding unit (there are 10 units in the bitstream).

# This turns off units 0 and 1.

#Config1 = \x03\x00

# This turns off all 10 units (resulting in a timeout).

#Config1_04A36E0FD6_0 = \xff\x03

[ZTEX:sha256crypt]

# Design tools reported possible frequency is 241 MHz but tested boards

# miss guesses, often fail unless frequency is decreased.

# Tested boards work reliably at 175.

Frequency = 175

#TargetRounds = 500000

# md5crypt and phpass use same bitstream. Design tools reported

# possible frequency is 202 MHz. Tested boards run OK at 180 MHz.

[ZTEX:md5crypt]

Frequency = 180

[ZTEX:phpass]

Frequency = 180

#TargetRounds = 2048

# These formats are disabled from all-formats --test runs, or auto-selection

# of format from an input file. Even when disabled, you can use them as long

# as you spell them out with the --format option. Or you can delete a line,

# comment it out, or change to 'N'

[Disabled:Formats]

#formatname = Y

.include '$JOHN/dynamic_disabled.conf'

[Formats:7z]

# With this enabled, the 7z formats check padding after AES decryption which

# more or less guarantees we don't get any false positives, and also makes

# the formats faster (in some cases a LOT faster). We've had one (1) report

# of getting a false negative having this enabled though, so if you fail to

# crack some archive you may want to disable this and re-try all attacks.

TrustPadding = Y

# This allows you to list a few words/names that will be used by single mode

# as if they were included in every GECOS field. Use sparingly! Please note

# that the example words are commented out, so the list is empty!

[List.Single:SeedWords]

#Pass

#Secret

#Test

# This allows you to read extra pot files when loading hashes. Nothing will

# ever be written to these files, they are just read. Any directory in this

# list will be traversed and files in it with an extension of .pot will be

# read. However there will NOT be any recursion down further directory levels.

# Any entries that don't exist will be silently ignored.

[List.Extra:Potfiles]

#somefile.pot

#somedirectory

#$JOHN/my.pot

[Debug]

# Changing this to Yes will enable legacy-style benchmarks, for comparisons

Benchmarks_1_8 = N

# Changing this to Yes will test salted formats as one/many salts, for debug

BenchmarkMany = N

[PRINCE]

# Default wordlist file name. Will fall back to standard wordlist if not

# defined.

Wordlist =

# Markov modes, see ../doc/MARKOV for more information

[Markov:Default]

# Default Markov mode settings

#

# Statsfile cannot be specified on the command line, so

# specifying it here is mandatory

Statsfile = $JOHN/stats

# MkvLvl and MkvMaxLen should also be specified here, as a fallback for

# --markov usage without specifying LEVEL and/or --max-length on the

# command line.

MkvLvl = 200

MkvMaxLen = 12

# MkvMinLvl and MkvMinLen should not be specified at all in [Markov:Default],

# or they should be equal to 0 (which is the default if not specified.

# MkvMinLvl and MkvMinLen can be used in other Markov mode sections

# except [Markov:Default]

; MkvMinLvl = 0

; MkvMinLen = 0

# A user defined character class is named with a single digit, ie. 0..9. After

# the equal-sign, just list all characters that this class should match. You

# can specify ranges within brackets, much like pre-processor ranges in rules.

# BEWARE of encoding if using non-ASCII characters. If you put UTF-8 characters

# here, it will *not* work! You must use a singlebyte encoding and it should

# be the same here as you intend to use for your dictionary.

# You can however put characters here in \xA3 format (for codepoint 0xA3 - in

# many iso-8859 codepages that would mean a pound sign). This works in ranges

# too. Using \x00 is not supported though - it will not be parsed as null.

#

# This is a couple of example classes:

# ?0 matches (one version of) base64 characters

# ?1 matches hex digits

# ?2 matches the TAB character (never try to use \x00!)

[UserClasses]

0 = [a-zA-Z0-9/.]

1 = [0-9a-fA-F]

2 = \x09

[Mask]

# When iterating over length, emit a status line after each length is done

MaskLengthIterStatus = Y

# Default mask for -mask if none is given. This is same as hashcat's default.

DefaultMask = ?1?2?2?2?2?2?2?3?3?3?3?d?d?d?d

# Default mask for Hybrid mask mode if none is given.

DefaultHybridMask = ?w?d?d?d?d

# Mask mode have custom placeholders ?1..?9 that look similar to user classes

# but are a different thing. They are merely defaults for the -1..-9 command

# line options. As delivered, they resemble hashcat's defaults.

1 = ?l?d?u

2 = ?l?d

3 = ?l?d*!$@_

4 =

5 =

6 =

7 =

8 =

9 =

[Subsets]

# When iterating over length, emit a status line after each length is done

LengthIterStatus = Y

# Min/Max number of unique characters. MaxDiff can't be set larger than 16.

MinDiff = 1

MaxDiff = 7

# Default charset, either a literal string or a single-digit number pointing

# to one of the sets below. If not defined, all printable ASCII is used.

DefaultCharset =

# Subsets mode charsets 0-9. These are literal strings. TAB and space

# characters can be used as long as they do not come first or last. The only

# "magic" used here is \U+HHHH or \U+HHHHH for any Unicode character (except

# the very highest private area that has six hex digits). For example, you

# could say \U+1F600 for a "Grinning Face".

0 = 0123456789abcdef

1 = ABCDEF0123456789

2 = 0123456789abcdefghijklmnopqrstuvwxyzàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿABCDEFGHIJKLMNOPQRSTUVWXYZÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞß !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿

3 = 0123456789άέήίαβγδεζηθικλμνξοπρςστυφχψωϊϋόύώΆΈΉΊΌΎΏΑΒΓΔΕΖΗΘΙΚΛΜΝΞΟΠΡΣΤΥΦΧΨΩΪΫ !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

4 = 0123456789абвгдежзийклмнопрстуфхцчшщъыьэюяёЁАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯ№ !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

5 =

6 =

7 =

8 =

9 =

[Regen_Salts_UserClasses]

# These are user defined character sets. Their purpose is to allow custom salt

# values to be used within the salt_regen logic. These will be the characters

# to use for this character within the salt. So if we had a salt that was 4

# characters, and 0-9a-m, we can easily do this by 0 = [0-9a-m]. If this is

# used, the regen salt value would be ?0?0?0?0 and salts such as a47m 2kd5

# would be valid.

1 = [1-9]

# A "no rules" rule for eg. super-fast Single mode (use with --single=none)

[List.Rules:None]

:

# A "drop all" rule for even faster Single mode (debugging :)

[List.Rules:Drop]

<1'0

# These are good rules on larger sites where a user ID may already be used,

# so a user simply appends numbers to create his loginID, but then uses the

# login name he wanted as basis for password. Just strip off digits and treat

# the base-word to some manipulation. These rules found from the 2015 A-M

# leak. Only adds 30-50 permutations and only applied to user names that have

# digits contained within them, and cracks quite a few.

# These are currently Jumbo-specific.

[List.Rules:JumboSingle]

/?d @?d >4

/?d @?d M @?A >4 Q

-c /?d @?d >4 M [lc] Q

-c /?d @?d M @?A >4 Q M [lc] Q

@?D Q >4

/?d @?d >3 <* $[0-9] Q

-c /?d @?d >3 <* M [lc] Q $[0-9]

/?d @?d >3 <- Az"12" <+ Q

-c /?d @?d >3 <- M [lc] Q Az"12" <+

/?d @?d >3 Az"123" <+ Q

-c /?d @?d >3 M [lc] Q Az"123" <+

/?d @?d >2 al d

-c /?d @?d >2 al M [lc] Q d

(?a )?d /?d a0 'p Xpz0

)?a (?d /?a a0 'p Xpz0

# "Single crack" mode rules

[List.Rules:Single]

# Simple rules come first...

:

-s x**

-c (?a c Q

-c l Q

-s-c x** /?u l

# These were not included in crackers I've seen, but are pretty efficient,

# so I include them near the beginning

-<6 >6 '6

-<7 >7 '7 l

-<6 -c >6 '6 /?u l

-<5 >5 '5

# Wedge the Jumbo-specific addons in here!

.include [List.Rules:JumboSingle]

# Weird order, eh? Can't do anything about it, the order is based on the

# number of successful cracks...

<* d

r c

-c <* (?a d c

-<5 -c >5 '5 /?u l

-c u Q

-c )?a r l

-[:c] <* !?A \p1[lc] p

-c <* c Q d

-<7 -c >7 '7 /?u

-<4 >4 '4 l

-c <+ (?l c r

-c <+ )?l l Tm

-<3 >3 '3

-<4 -c >4 '4 /?u

-<3 -c >3 '3 /?u l

-c u Q r

<* d M 'l f Q

-c <* l Q d M 'l f Q

# About 50% of single-mode-crackable passwords get cracked by now...

# >2 x12 ... >8 x18

>[2-8] x1\1

>9 \[

# >3 x22 ... >9 x28

>[3-9] x2\p[2-8]

# >4 x32 ... >9 x37

>[4-9] x3\p[2-7]

# >2 x12 /?u l ... >8 x18 /?u l

-c >[2-8] x1\1 /?u l

-c >9 \[ /?u l

# >3 x22 /?u l ... >9 x28 /?u l

-c >[3-9] x2\p[2-8] /?u l

# >4 x32 /?u l ... >9 x37 /?u l

-c >[4-9] x3\p[2-7] /?u l

# Now to the suffix stuff...

<* l $[1-9!0a-rt-z"-/:-@\[-`{-~]

-c <* (?a c $[1-9!0a-rt-z"-/:-@\[-`{-~]

-[:c] <* !?A (?\p1[za] \p1[lc] $s M 'l p Q X0z0 'l $s

-[:c] <* /?A (?\p1[za] \p1[lc] $s

<* l r $[1-9!]

-c <* /?a u $[1-9!]

-[:c] <- (?\p1[za] \p1[lc] Az"'s"

-[:c] <- (?\p1[za] \p1[lc] Az"!!"

-[:c] (?\p1[za] \p1[lc] $! <- Az"!!"

# Removing vowels...

-[:c] /?v @?v >2 (?\p1[za] \p1[lc]

/?v @?v >2 <* d

# crack -> cracked, crack -> cracking

<* l [PI]

-c <* l [PI] (?a c

# mary -> marie

-[:c] <* (?\p1[za] \p1[lc] )y omi $e

# marie -> mary

-[:c] (?\p1[za] \p1[lc] )e \] <+ )i val1 oay

# The following are some 3l33t rules

-[:c] l /[aelos] s\0\p[4310$] (?\p1[za] \p1[:c]

-[:c] l /a /[elos] sa4 s\0\p[310$] (?\p1[za] \p1[:c]

-[:c] l /e /[los] se3 s\0\p[10$] (?\p1[za] \p1[:c]

-[:c] l /l /[os] sl1 s\0\p[0$] (?\p1[za] \p1[:c]

-[:c] l /o /s so0 ss$ (?\p1[za] \p1[:c]

-[:c] l /a /e /[los] sa4 se3 s\0\p[10$] (?\p1[za] \p1[:c]

-[:c] l /a /l /[os] sa4 sl1 s\0\p[0$] (?\p1[za] \p1[:c]

-[:c] l /a /o /s sa4 so0 ss$ (?\p1[za] \p1[:c]

-[:c] l /e /l /[os] se3 sl1 s\0\p[0$] (?\p1[za] \p1[:c]

-[:c] l /[el] /o /s s\0\p[31] so0 ss$ (?\p1[za] \p1[:c]

-[:c] l /a /e /l /[os] sa4 se3 sl1 s\0\p[0$] (?\p1[za] \p1[:c]

-[:c] l /a /[el] /o /s sa4 s\0\p[31] so0 ss$ (?\p1[za] \p1[:c]

-[:c] l /e /l /o /s se3 sl1 so0 ss$ (?\p1[za] \p1[:c]

-[:c] l /a /e /l /o /s sa4 se3 sl1 so0 ss$ (?\p1[za] \p1[:c]

# Now to the prefix stuff...

l ^[1a-z2-90]

-c l Q ^[A-Z]

^[A-Z]

l ^["-/:-@\[-`{-~]

-[:c] <9 (?a \p1[lc] A0"[tT]he"

-[:c] <9 (?a \p1[lc] A0"[aA]my"

-[:c] <9 (?a \p1[lc] A0"[mdMD]r"

-[:c] <9 (?a \p1[lc] A0"[mdMD]r."

-[:c] <9 (?a \p1[lc] A0"__"

<- !?A l p ^[240-9]

# Some word pair rules...

# johnsmith -> JohnSmith, johnSmith

-p-c (?a 2 (?a c 1 [cl]

# JohnSmith -> john smith, john_smith, john-smith

-p 1 <- $[ _\-] + l

# JohnSmith -> John smith, John_smith, John-smith

-p-c 1 <- (?a c $[ _\-] 2 l

# JohnSmith -> john Smith, john_Smith, john-Smith

-p-c 1 <- l $[ _\-] 2 (?a c

# johnsmith -> John Smith, John_Smith, John-Smith

-p-c 1 <- (?a c $[ _\-] 2 (?a c

# Applying different simple rules to each of the two words

-p-[c:] 1 \p1[ur] 2 l

-p-c 2 (?a c 1 [ur]

-p-[c:] 1 l 2 \p1[ur]

-p-c 1 (?a c 2 [ur]

# jsmith -> smithj, etc...

-[:c] (?a \p1[lc] [{}]

-[:c] (?a \p1[lc] [{}] \0

# Toggle case...

-c <+ )?u l Tm

-c T0 Q M c Q l Q u Q C Q X0z0 'l

-c T[1-9A-E] Q M l Tm Q C Q u Q l Q c Q X0z0 'l

-c l Q T[1-9A-E] Q M T\0 Q l Tm Q C Q u Q X0z0 'l

-c >2 <G %2?a [lu] T0 M T2 T4 T6 T8 TA TC TE Q M l Tm Q X0z0 'l

-c >2 /?l /?u t Q M c Q C Q l Tm Q X0z0 'l

# Deleting chars...

>[2-8] D\p[1-7]

>[8-9A-E] D\1

-c /?u >[2-8] D\p[1-7] l

-c /?u >[8-9A-E] D\1 l

=1?a \[ M c Q

-c (?a >[1-9A-E] D\1 c

# Inserting a dot...

-[:c] >3 (?a \p1[lc] i[12].

# More suffix stuff...

<- l Az"[190][0-9]"

-c <- (?a c Az"[190][0-9]"

<- l Az"[782][0-9]"

-c <- (?a c Az"[782][0-9]"

<* l $[A-Z]

-c <* (?a c $[A-Z]

# cracking -> CRACKiNG

-c u /I sIi

# Crack96 -> cRACK96

%2?a C Q

# Crack96 -> cRACK(^

/?A S Q

# Crack96 -> CRaCK96

-c /?v V Q

# Really weird charset conversions, like "england" -> "rmh;smf"

:[RL] Q

l Q [RL]

-c (?a c Q [RL]

:[RL] \0 Q

# Both prefixing and suffixing...

<- l ^[1!@#$%^&*\-=_+.?|:'"] $\1

<- l ^[({[<] $\p[)}\]>]

# The rest of two-digit suffix stuff, less common numbers...

<- l Az"[63-5][0-9]"

-c <- (?a c Az"[63-5][0-9]"

# Some multi-digit numbers...

-[:c] (?a \p1[lc] Az"007" <+

-[:c] (?a \p1[lc] Az"123" <+

-[:c] (?a \p1[lc] Az"[0-9]\0\0" <+

-[:c] (?a \p1[lc] Az"1234" <+

-[:c] (?a \p1[lc] Az"[0-9]\0\0\0" <+

-[:c] (?a \p1[lc] Az"12345" <+

-[:c] (?a \p1[lc] Az"[0-9]\0\0\0\0" <+

-[:c] (?a \p1[lc] Az"123456" <+

-[:c] (?a \p1[lc] Az"[0-9]\0\0\0\0\0" <+

# Some [birth] years...

l Az"19[7-96-0]" <+ >-

l Az"20[01]" <+ >-

l Az"19[7-9][0-9]" <+

l Az"20[01][0-9]" <+

l Az"19[6-0][9-0]" <+

[List.Rules:Extra]

# Insert/overstrike some characters...

!?A >[1-6] l i\0[a-z]

!?A l o0[a-z]

!?A >[1-7] l o\0[a-z]

# Toggle case everywhere (up to length 8), assuming that certain case

# combinations were already tried.

-c T1 Q M T0 Q

-c T2 Q M T[z0] T[z1] Q

-c T3 Q M T[z0] T[z1] T[z2] Q

-c T4 Q M T[z0] T[z1] T[z2] T[z3] Q

-c T5 Q M T[z0] T[z1] T[z2] T[z3] T[z4] Q

-c T6 Q M T[z0] T[z1] T[z2] T[z3] T[z4] T[z5] Q

-c T7 Q M T[z0] T[z1] T[z2] T[z3] T[z4] T[z5] T[z6] Q

# Very slow stuff...

l Az"[1-90][0-9][0-9]" <+

-c (?a c Az"[1-90][0-9][0-9]" <+

<[\-9] l A\p[z0]"[a-z][a-z]"

<- l ^[a-z] $[a-z]

# Wordlist mode rules

[List.Rules:Wordlist]

# Try words as they are

:

# Lowercase every pure alphanumeric word

-c >3 !?X l Q

# Capitalize every pure alphanumeric word

-c (?a >2 !?X c Q

# Lowercase and pluralize pure alphabetic words

<* >2 !?A l p

# Lowercase pure alphabetic words and append '1'

<* >2 !?A l $1

# Capitalize pure alphabetic words and append '1'

-c <* >2 !?A c $1

# Duplicate reasonably short pure alphabetic words (fred -> fredfred)

<7 >1 !?A l d

# Lowercase and reverse pure alphabetic words

>3 !?A l M r Q

# Prefix pure alphabetic words with '1'

>2 !?A l ^1

# Uppercase pure alphanumeric words

-c >2 !?X u Q M c Q u

# Lowercase pure alphabetic words and append a digit or simple punctuation

<* >2 !?A l $[2!37954860.?]

# Words containing punctuation, which is then squeezed out, lowercase

/?p @?p >3 l

# Words with vowels removed, lowercase

/?v @?v >3 l

# Words containing whitespace, which is then squeezed out, lowercase

/?w @?w >3 l

# Capitalize and duplicate short pure alphabetic words (fred -> FredFred)

-c <7 >1 !?A c d

# Capitalize and reverse pure alphabetic words (fred -> derF)

-c <+ >2 !?A c r

# Reverse and capitalize pure alphabetic words (fred -> Derf)

-c >2 !?A l M r Q c

# Lowercase and reflect pure alphabetic words (fred -> fredderf)

<7 >1 !?A l d M 'l f Q

# Uppercase the last letter of pure alphabetic words (fred -> freD)

-c <+ >2 !?A l M r Q c r

# Prefix pure alphabetic words with '2' or '4'

>2 !?A l ^[24]

# Capitalize pure alphabetic words and append a digit or simple punctuation

-c <* >2 !?A c $[2!3957468.?0]

# Prefix pure alphabetic words with digits

>2 !?A l ^[379568]

# Capitalize and pluralize pure alphabetic words of reasonable length

-c <* >2 !?A c p

# Lowercase/capitalize pure alphabetic words of reasonable length and convert:

# crack -> cracked, crack -> cracking

-[:c] <* >2 !?A \p1[lc] M [PI] Q

# Try the second half of split passwords

-s x**

-s-c x** M l Q

# Case toggler for cracking MD4-based NTLM hashes (with the contributed patch)

# given already cracked DES-based LM hashes. Use --rules=NT to use this.

[List.Rules:NT]

:

-c T0Q

-c ->2 a0 T1QT[z0]

-c ->3 a0 T2QT[z0]T[z1]

-c ->4 a0 T3QT[z0]T[z1]T[z2]

-c ->5 a0 T4QT[z0]T[z1]T[z2]T[z3]

-c ->6 a0 T5QT[z0]T[z1]T[z2]T[z3]T[z4]

-c ->7 a0 T6QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]

-c ->8 a0 T7QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]

-c ->9 a0 T8QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]

-c ->A a0 T9QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]

-c ->B a0 TAQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]

-c ->C a0 TBQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]T[zA]

-c ->D a0 TCQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]T[zA]T[zB]

-c ->E a0 TDQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]T[zA]T[zB]T[zC]

# Shift toggler, up to length 16

[List.Rules:ShiftToggle]

:

W0Q

->2 a0 W1QW[z0]

->3 a0 W2QW[z0]W[z1]

->4 a0 W3QW[z0]W[z1]W[z2]

->5 a0 W4QW[z0]W[z1]W[z2]W[z3]

->6 a0 W5QW[z0]W[z1]W[z2]W[z3]W[z4]

->7 a0 W6QW[z0]W[z1]W[z2]W[z3]W[z4]W[z5]

->8 a0 W7QW[z0]W[z1]W[z2]W[z3]W[z4]W[z5]W[z6]

->9 a0 W8QW[z0]W[z1]W[z2]W[z3]W[z4]W[z5]W[z6]W[z7]

->A a0 W9QW[z0]W[z1]W[z2]W[z3]W[z4]W[z5]W[z6]W[z7]W[z8]

->B a0 WAQW[z0]W[z1]W[z2]W[z3]W[z4]W[z5]W[z6]W[z7]W[z8]W[z9]

->C a0 WBQW[z0]W[z1]W[z2]W[z3]W[z4]W[z5]W[z6]W[z7]W[z8]W[z9]W[zA]

->D a0 WCQW[z0]W[z1]W[z2]W[z3]W[z4]W[z5]W[z6]W[z7]W[z8]W[z9]W[zA]W[zB]

->E a0 WDQW[z0]W[z1]W[z2]W[z3]W[z4]W[z5]W[z6]W[z7]W[z8]W[z9]W[zA]W[zB]W[zC]

->F a0 WEQW[z0]W[z1]W[z2]W[z3]W[z4]W[z5]W[z6]W[z7]W[z8]W[z9]W[zA]W[zB]W[zC]W[zD]

->G a0 WFQW[z0]W[z1]W[z2]W[z3]W[z4]W[z5]W[z6]W[z7]W[z8]W[z9]W[zA]W[zB]W[zC]W[zD]W[zE]