22.3 John the Ripper: Cracking Hashes
John the Ripper ("John") cracks captured hashes offline. It auto-detects many hash types.
# Linux: combine passwd and shadow into one file John understands (root/lab only)
sudo unshadow /etc/passwd /etc/shadow > hashes.txt
# wordlist attack
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
# with mutation rules
john --wordlist=/usr/share/wordlists/rockyou.txt --rules hashes.txt
# show cracked results
john --show hashes.txt
# tell John the format if it guesses wrong
john --format=sha512crypt --wordlist=rockyou.txt hashes.txt
John also has helper tools such as zip2john file.zip > zip.hash and ssh2john id_rsa > key.hash to turn protected files and keys into crackable hashes (lab only).
Ravindra Bagale's Tip
John keeps running in the background, and students press Ctrl+C to stop it, then say "nothing happened". Use john --show to see earlier results, and while it is running, pressing any key shows the status – it does not stop. Be patient.
Ravindra Bagale's Tip – मराठी
John background मध्ये चालू असतो आणि students Ctrl+C दाबून बंद करतात, मग "काही झालं नाही" म्हणतात. john --show ने आधीचे results बघा, आणि चालू असताना कोणतीही key दाबली तर status दिसतो – बंद होत नाही. Patience ठेवा.
Ravindra Bagale's Tip – हिंदी
John background में चलता रहता है और students Ctrl+C दबाकर बंद कर देते हैं, फिर कहते हैं "कुछ नहीं हुआ". john --show से पुराने results देखो, और चलते समय कोई भी key दबाओ तो status दिखता है – वह बंद नहीं होता. Patience रखो.
Lab
On Metasploitable 2 (or your own lab Linux VM), run sudo unshadow and crack the hashes with John using rockyou.txt and --rules. List which accounts cracked and how long each took. Then set a long random password on one account and confirm John cannot crack it quickly.