Question about FAST

[Thomas Kula]

On Thu, Jul 08, 2010 at 01:14:23PM -0700, Henry B. Hotz wrote:
> I've never run JtR myself.  Just talked to people who have.  It seems to be popular at AFS installations.
> 
> My impression was that it required a dump of the kerberos database to operate.  Presumably the JtR documentation is the place to go (not me).
> 

We run JtR here at UMICH as part of an auditing process. It
does require a dump of the kerberos database, and we have a
perl script that takes the dump, looks for AFS3 salted 
single-des keys and turns them into a format we can pass
into JtR. 

I have no idea how you'd use a captured AS_REP going by
to do an offline dictionary attack with JtR, or even if
JtR is the most effective tool for attempting that.



-- 
Thomas L. Kula | kula at tproa.net | http://kula.tproa.net/