Broken lower-case mssql hash validation about john HOT 1 CLOSED

Thank you for reporting this, @sjanusz-r7!

We were under impression that tools standardized on uppercase for MS SQL hashes. Since for many other hashes the case of characters in their encodings matters, we do not universally support arbitrary/mixed case.

I've prepared a patch for this issue to have our three MS SQL formats support both upper and lower case, by unifying to upper case for writing to pot files, like we already do e.g. in mysqlSHA1_fmt_plug.c. I'm also setting FMT_SPLIT_UNIFIES_CASE for consistency, even though I think it no longer matters after #4429 as mentioned in #4430. We'll need to clean that up separately.

While at it, I was also interested in how easily crackable your test password is. Turns out our current default settings (no options at all, just the filename) do crack it, but that takes a minute on a laptop CPU. However, putting only the word password in a wordlist file and using -ru=by-rate -rules-stack=by-score cracks it instantly. So our default wordlist rules are powerful enough to crack this given other manglings of this word already present in our default password.lst, but not powerful enough to crack it from just the original word password, for which dual application of our larger rule set is needed. All of this pertains to our latest settings in here, which were replaced in January 2022, so your build from November 2021 probably doesn't have this and would have a harder time cracking this password.

from john.