Wordlist mode rulesets for use with John the Ripper

These are some rulesets that you may put into your john.conf file and invoke with –rules=NAME (specifying the section NAME) on the command-line (this option syntax requires the jumbo patch).

• KoreLogic's original rules as released right after the DEFCON 2010 contest. This file was downloaded from http://contest.korelogic.com/rules.html and it was originally called simply rules.txt.
• A revision of the above combining all sections into a single KoreLogicRules section. This is only intended for testing, not for actual use, since the sections are combined in the order they were listed in the original rules.txt, which did not reflect an optimal order for their use. Additionally, different sections were intended for use with wordlists of different size.
• KoreLogic rules above reworked by Solar Designer to make better use of the preprocessor (the file became 3 times smaller, and the number of lines 10 times smaller), to produce fewer duplicates (especially with length-limited and/or case-insensitive hash types), to generate some kinds of candidate passwords that were inadvertently missed by KoreLogic (because of implementation bugs in the original rules.txt), and to avoid generating candidate passwords that were likely being generated unintentionally (again, because of bugs).
• A revision of the above combining all sections into a single KoreLogicRules section. Only intended for testing, for the reason mentioned above.

The rulesets above were announced/documented on john-users.

• More year-based password cracking rules (2009/03/27)
• New john.conf rules (Part 2) (2009/04/24)
• Generation method and generated prepend and append rules JimF (2009/07/27)
• A serie of posts about another generation method (part 1, 2, 3, 4 and an update). The tool is here.

Back to John the Ripper user community resources.