In this video I'll show you how to crack passwords using brute force attack.
We'll dive into John the Ripper which is probably the most widely used password cracking tool out there.
John he Ripper is designed to be both feature-rich and fast.
It combines several cracking marks and supports a lot of hashing protocols. Community enhanced jumble
versions
add support for Windows iNTLM hashes, MacOS or sha-256 or 512 salted
hashes. Before starting
John let's talk a little bit about the available cracking modes.
There are 3 cracking modes available: single track mode, dictionary attack and incremental mode. Single
crack mode is the mode you should start cracking with.
It will use the logging names together with other fields from the past start to file,
also with a large set of mangling rules applied.
This is the fastest cracking mode and it is applicable to very simple passwords.
If you use the dictionary attack you must supply a dictionary file that contains one word per line
and the password file.
You can enable word mangling rules which are used to modify or mangle words producing other likely passwords.
If enabled all the rules will be applied to every line in the world list file producing multiple candidate
passwords for each source word. And the most powerful cracking mode is the incremental mode.
It will try all possible character combinations as passwords.
However if you supply a random password with a length of more than 12 or 14 characters it will never
terminate and you'll have to interrupt it manually.
Okay, let's get started!
On Kali Linux
John the Ripper is already installed.
But if you use another distribution you can simply install it by executing apt install john.
It's already
the newest version.
The first step is to combine the provided password and shadow files into a single file.
There is the unshadow command which is part of the John package that does that. unshadow
the password file and the shadow file > or the output redirection and the file that
combines these two files. Let's say unshadowed.txt
Let's see the file!
Okay, we have the user and the hash! Perfect! Let's start john in single mode.
john -single unshadowed.txt
It has finished.
Let's check if it has found something.
john --show
and the file unshadowed.txt and we notice that it cracked two passwords: the password of
user Kali,
the default user of Kali Linux starting with version 2020.1 which is Kali and
the password of the user admin,
which is also admin. In just a few seconds
he has cracked the default password of the default user of Kali Linux. Once again the single mode is
only good to crack
very simple passwords.
When John finds a password it saves it in this file, in the home directory
of the user that has executed John, in a hidden directory called John.
john.pot. This is where it saves the passwords! Let's try a brute force dictionary attack.
John the Ripper comes with its own passwords
lists in /usr/share/john
For example password.lst
is such a dictionary file.
There are also some dictionary files in any Linux distribution, /usr/share/dict/. To check how many
entries are in a dictionary file you execute wc -l and the file.
For example in this file American English there is this number of words.
Okay, let's start John using the dictionary that comes with it.
john --wordlist= and tha pass to the file /usr/share
/john/password.lst --rules and the file that contains the hashes of the passwords
unshadowed.txt
--rules enables words mangling rules.
Okay!
It has already cracked two passwords: user 1 and user 2,
both have the same password,
test, it's from the previous lecture and the user mark with the password
"arsenal".
At this moment John's running and trying to crack other passwords; while cracking you can press any
key
for status or Ctr + C to abort.
It has aborted the station and created a saving point information. If you press Ctr+ C twice
John will abort immediately without saving. If I want to see cracked passwords I execute john
--show and the file unshadowed.txt. Okay, only two minus signs; it has correct five passwords.
To continue uninterrupted session run john -restore, in the same directory,
very important.
And the cracking session was restored and it has completed the session! Once again
run this comment in the same direct directory where you have aborted the session you want to restore.