‫John the Ripper is a fast password cracker currently available for many flavors of Unix windows, doors
‫and open VMS.
‫Initially developed for the Unix operating system, it now runs on 15 different platforms.
‫It's one of the most popular password testing and breaking programs as it combines a number of password
‫crackers into one package.
‫Auto detects password hash types and includes a customizable cracker.
‫John the Ripper is free and open source software distributed primarily in source code form.
‫If you'd rather use a commercial product tailored for your specific operating system, please consider
‫John the Ripper Pro.
‫Which is distributed primarily in the form of native packages for the target operating systems and in
‫general, it's meant to be easier to install and use while delivering optimal performance.
‫Now there is another version of John, which is the community enhanced version.
‫This version integrates lots of contributed patches, adding GPU support, OpenCL and CUDA for 100 additional
‫hash and cipher types, including popular ones such as native limb, raw MD5, etc. and even things
‫such as encrypted openness that's age, private key ZIP and RJR archives, PDF files, etc..
‫As well as some optimizations and features.
‫So let's see, John the river in action.
‫Official, free and open source version of John the Ripper is embedded in Kiwi.
‫If you type John with no parameter, you'll see the manual page of the tool, you see the usage and
‫all the options of John.
‫Let's build an offline dictionary attack with John.
‫The first parameter is the word list.
‫Don't forget to put the equals sign after the parameter.
‫Name of the dictionary file with the full path comes here.
‫So I'll open another terminal screen and search for a password list using the fine command.
‫Now there is a folder called word lists under the Metasploit Framework folder.
‫Let's go to that folder to see its content.
‫And there are a lot of word lists here for different purposes.
‫Right now, I want to look at the length of the password list file.
‫Cat password, dot less tip pipe w c four word count.
‫The first one is the number of lines and the second one is a number of words, which is the same with
‫a line numbers.
‫And the third one is the number of characters.
‫So there are about 90000 passwords in this list.
‫I visit a file with less command.
‫You can search a word inside the last command by pressing the slash button.
‫So I'll search for the password of the administrator.
‫No result.
‫MSF admin, no result.
‫So note here that these steps are just to have successful result in a typical penetration test.
‫You won't know the passwords of the victim systems.
‫Beyond that, if you already know the password of the victim, well, what's the reason for adding it
‫to a dictionary and then finding it again?
‫Suppose that these steps never happen, and the words were already in the list were used, right?
‫Now I'll open the dictionary and add a few words, so I'll repeat that we're just supposing that the
‫process never happened and the words were already in the list.
‫But I just want to show you the mechanics of it.
‫So now we can use this list as the word list in John.
‫So, right, the file name with the full power.
‫The second parameter is the hash file.
‫Now I'll run the command, adding no more parameters for.
‫So if you don't specify the hash pipe, John, to tax itself, it detected the hash type as elm and
‫warns us about the anti hash.
‫And here are the result.
‫Guest password is empty.
‫It also shows the first part of the administrators hash and the second part of Cyber Labs Hash.
‫And as you see here in all uppercase letters.
‫Now, I'll recall the latest command and add the format parameter is in this time and hit enter.
‫Here are the results.
‫Now we see all the letters in their own format, uppercase or lowercase.
‫So now I want to try to crack the Windows eight hashes.
‫So I'll give it a hash file of the Windows eight system this time.
‫I remove the format parameter and run the command.
‫John reckons the hashes as ILM and got no result.
‫So let's give the hash format.
‫Now we have a result.
‫Password of a Udemy user is Udemy 12.
‫But wait a sec.
‫When it was eight, as a user with the password, one two three four QQQ uppercase Q and Dot, which
‫is the same with the password of the administrator user of Windows XP.
‫We know that the word is in the dictionary, so why couldn't John crack it?
‫Well, the answer is inside the John Scott pot file.
‫So let's find his location using the Find Linux command.
‫And let's see the content of the file with a cat command.
‫So, John stores the findings in John Port Potty File with the hash format.
‫And if it finds the same hash with the same format, it doesn't try to crack it again.
‫So you should look at the John Potti file for the hashes you try to crack with John, right?
‫So if we were on the latest command again, it won't crack any hash because they've all been cracked
‫before.
‫So if you delete the jackpot file.
‫And run the latest command again, you'll see all the crack results of the hash file.
‫Good, so let's move on and try to crack the hashes of the Metasploit about Linux VM now the hash file
‫is hash M2 text.
‫And don't give the format parameter.
‫I'll let John detect the hash type and hit enter.
‫So it detected the harsh type as MD5 crypt.
‫And that's correct.
‫So look at that.
‫We crack passwords, the passwords of the Metasploit, all users are not so complicated, aren't they?
‫So look at the John Pott file once more.
‫And now you see the new hash is stored with hash pipe, one where one stands for MD5.
‫Excellent.