[TOOL] DJohn - Distributed John

From: SecuriTeam (support_at_securiteam.com)
Date: 11/19/03

  • Next message: SecuriTeam: "[NEWS] Half Life Dedicated Server Information Leak and DoS" 
    To: list@securiteam.com
Date: 19 Nov 2003 18:54:10 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      DJohn - Distributed John
    ------------------------------------------------------------------------

    DETAILS

    With Distributed John (DJohn) you can crack passwords using several
    machines to get passwords sooner than using a single machine. The cracking
    in itself is done by John The Ripper and djohn's server (djohnd) divides
    the work in work packets and coordinates the effort among the clients
    (djohn), which are the ones who do the work.

    Because the way djohn was written there are several features/drawbacks on
    which you might be interested:

     * Only brute force cracking can be used; as the way to crack passwords is
    with an external mode (read John's documentation for more information on
    John's cracking modes)

     * There is no support to download the passwords files to be cracked by
    the clients. They must be downloaded by someone else (the user, another
    process). Starting in v0.9.8, there is a contributed server / client in
    Perl to do this task

     * DJohn was designed to run in closed networks where all the clients can
    be trusted, so security was not an issue

     * All the clients are supposed to have the same (or similar) CPU power
    (this point will be addressed soon)

    The server status can be viewed using the utility djs (djohn status) and a
    CGI front-end is provided to remotely view to server status (djs can only
    be used in the machine the server is running as it uses shared memory to
    get the status).

    ADDITIONAL INFORMATION

    The tool can be downloaded from: <http://ktulu.com.ar/en/djohn.php>
    http://ktulu.com.ar/en/djohn.php.

    The information has been provided by <mailto:webmaster@ktulu.com.ar> Luis
    Parravicini.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Half Life Dedicated Server Information Leak and DoS"

    Relevant Pages

    • [NT] Colin McRae Rally DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... crash user's clients that connect to the server. ... the game server when entering the multiplayer menu. ...
      (Securiteam)
    • [NT] Live for Speed Clients Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Live for Speed Clients Buffer Overflow ... Client buffer-overflow during skins handling allows remote attacker (other ... client or the server) to execute malicious code on the vulnerable system. ...
      (Securiteam)
    • [NT] Multiple Vulnerabilities in HP Web JetAdmin (Read, Write, Execute, Path Disclosure, Password De
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... HP Web JetAdmin is an enterprise management system for large amounts of HP ... The web server is a modular service ... HP Web JetAdmin uses it's own encryption. ...
      (Securiteam)
    • [NEWS] Multiple Vulnerabilities in Oracle Database (Character Conversion, Extproc, Password Disclosu
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple vulnerabilities were discovered in the (Oracle database server ... password is required to exploit this vulnerability. ...
      (Securiteam)
    • [NEWS] ColdFusion MX Oversize Error Message DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... ColdFusion MX "is the solution for building and deploying powerful web ... shoots up and stays there until the server completes writing the error ... a long string of data as a GET or POST request to ...
      (Securiteam)