John the Ripper
Table of Contents
John the Ripper (JtR)
John the Ripper (JtR) is another tool that can be used to attack password-based systems.
It is a tool best suited to crack a large number of passwords (based on different algorithms), using dictionary attacks and brute-force (offline attacks). In order to understand the options that this tool offers you should use following command and analyze them in detail:
JtR is essentially used for attacks on offline files that contain some type of passwords. Imagine a scenario where you obtain a file with a set of passwords (which are protected in some way) and you want to find out (crack) the original passwords - this is a task for JtR.
This tool can take advantage of extra hardware in the machine, such as GPUs, to speed up the password discovery process.
Using JtR to crack passwords on a Linux system
In this case, let us try to find out the passwords of users on a Linux system. The first we need to do (for demo purposes) is to get the passwords and save them to a file (we can do this on the Kali Linux system):
This will save the passwords in a file (allpasswords). Lets open the file and check its content (if you can't get the file, download it from here).
Format:
The passwords on a Linux system are usually encrypted using an algorithm called crypt. Therefore this information is important for the JtR tool.
Using a brute-force approach
To do a brute-force attack we can simply do:
--format indicates the format of the passwords on the file (allpasswords)
As you may notice, this will take a looooong time! Look at the CPU consumption and check the ETA...
Using a dictionary approach
In order to save time, we may try to use a dictionary attack instead. In order to do that we need to do the following, using a dictionary (passwords.txt):
If the word list contains a password we obtain a result really fast.
Note: if nothing is refered, the discovered passwords are stored in the ~/.john/john.pot file. If we like to specify any other pot location, we need to use the --pot option.
Cracking MD5 password files
Now we are going to use larger dimension files, to explore JtR funcionalities. First we are going to download the Rockyou password file (rockyou.txt). We can download this file from here.
After this, we are going to download some files from the "Crack Me If You Can (DEFCON 2012)" page.
We this page we can download this file.
Uncompress the file:
From all the files that are extracted, we are going to use this one:
This file contains raw MD5 passwords and has the following format:
So lets try to find some passwords using JtR to do a dictionary attack:
And lets cross our fingers. Here are the results:
All the dicovered passwords are recorded to the found.pot file - as specified in the command. Look at its content:
Another important issue to consider when using a dictionary attack is to look at word mangling rules that JtR can use to do combinations with the words in the dictionary. For more information about this, please check this and this, and then try to use.
We can also use a brute force approach for this. In order to do that we can do the following:
But this will take a very long time!!!
Cracking password protected files
Another useful feature that JtR offers is the possibility to crack a password of a file, namely zip files. So lets try to do that.
First we need a password-protected zip file. Either you can create your own file, or you can use this file, that I've prepared previously (logo.zip).
The first thing we need to do is to extract the hash part of the file that contains the password. To to that we'll use the following command:
The file.hash has the following content.
Next, we'll use a dictionary attack to try to find the password. The dictionary that we'll use is the rockyou.txt file. The command is as follows:
And lets look at what we've found.
References/Additional information
Last updated