In order to crack passwords in an offline mode you must first obtain the hashes stored within the operating
system.
In our case the operating system is Windows and these hashes are stored in the sound file which is located
in C Windows system 32 config if you try to open the same file here.
It will tell you that it cannot be opened.
So obviously this file is not accessible while the operating system is booted.
If you have physical access to the device in question you can run a Linux live C.D. which is capable
of reading NTFS drives and capable of mounting the windows partitions.
This way you will copy the some file easily to external media.
If you're not comfortable doing that you can use nor does a flat empty password edit turn which will
do the same as well you will be able to read the sound file for the purpose of this tutorial just go
online to open a little dot com and download a copy of BW dump or password dump just extract this folder
to your Windows machine on the C drive.
This is password dump here.
Then go to the command line run it and Adam mode and go to the password dumb
then issue the command P.W..
Dump the XP then redirect the output to crack the TO.
YOU SHOULD GO THROUGH THE PASSWORD dump folder and open the cracked THC.
You'll see that the hashes has been dumped here and you will see the list of usernames and the ideas
of the names.
Then you will see two hashes separated by column the hash on the left side is the old M hash and the
hash on the right side is the new NTA them hash which is more secure.
We'll take this hash here.
Copy it because we want to crack it and try to crack it.
Just copy this hash here and go to the Linux machine.
Open the terminal and now we want to create a file that has this hash.
So just use the command echo and then redirect the output to a file named in those hash key.
So now if you do the list again we have a text file here called Windows hash just see the contents of
the windows hash.
And here you go in the windows hash we have this hash that we are trying to crack.
No one use the application.
John the river in order to crack this hash.
John Doe represents only one of my favorite password cracking tools because it supports lots of hashes
so it's very easy.
Just type in John and help and you will pop up here.
The syntax is very easy to use.
John options and password file.
So let's see the hash is supported by John.
All right John.
Then lists equal format formats.
You'll see all the hashes that are supported by John here.
So let's try to crack this.
This has to that we just got from the windows machine.
So John and we need to specify the format.
If you don't specify the format John will kind of recognize the format on its own but in order to make
things easy We will tell him the format type of the hash which is empty.
Then you specify find that you want to grab which is Windows hash the key XY then you specify a word
list.
Any word list it can.
John can use its own word list.
You can download extra word lists see in the upcoming tutorials how to create good word lists but for
the sake of this video here I've created my own word list or list equal.
It's double LSD.
Just a random word list that I'm using and just hit enter again.
So obviously it's figured out the password and once John figures the password it was tor it and a file
called John dot but so tried to locate John Doe.
But and here you go.
Just copy that and try to open it in leaf pad.
And here you go.
This is our hash here.
Just a..
And this is the crack password.
Once John cracks a hash it stores it in the John Doe pot.
Fire.
So if you want to crack the same hash again it will not redo the effort unless you remove this file.
John supports advanced password manipulation.
Cracking by using the rules.
So if you want to see the rules you can issue this command here.
And these are the advanced rules that John might choose.
In order to crack a hash these rules include like adding trailer trading character alphanumeric capitalizing
etc. If you want to see the details of these rules just look at the file John dot coms and open it and
search for the word drool.
And you'll be able to see the details of the rules kick.
Such as this rule is called Single and these are the password manipulation techniques that it does.
The rule is called word list and a little called Extra which mainly does insertion for a strike of some
characters etc..
So you can just explore them on your own.