Ravindra BagaleCourses & study guides

22. Password Attacks

22.3 John the Ripper: Cracking Hashes

John the Ripper ("John") cracks captured hashes offline. It auto-detects many hash types.

# Linux: combine passwd and shadow into one file John understands (root/lab only)
sudo unshadow /etc/passwd /etc/shadow > hashes.txt

# wordlist attack
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
# with mutation rules
john --wordlist=/usr/share/wordlists/rockyou.txt --rules hashes.txt
# show cracked results
john --show hashes.txt
# tell John the format if it guesses wrong
john --format=sha512crypt --wordlist=rockyou.txt hashes.txt

John also has helper tools such as zip2john file.zip > zip.hash and ssh2john id_rsa > key.hash to turn protected files and keys into crackable hashes (lab only).

Ravindra Bagale's Tip

John keeps running in the background, and students press Ctrl+C to stop it, then say "nothing happened". Use john --show to see earlier results, and while it is running, pressing any key shows the status – it does not stop. Be patient.

Lab

On Metasploitable 2 (or your own lab Linux VM), run sudo unshadow and crack the hashes with John using rockyou.txt and --rules. List which accounts cracked and how long each took. Then set a long random password on one account and confirm John cannot crack it quickly.