I want to spend a few moments talking about password lists.
Password lists contain multitudes of commonly‑used passwords.
Many of these lists contain passwords from data leaks,
which have been published publicly.
You will be surprised how often those leaked passwords are still being used.
By using a password list with John the Ripper,
it'll increase your chances of success in cracking a specific hash.
There are a number of password lists that are available on the internet.
My favorites are those that are found in SecLists, Crackstation, and Weakpass.
In this course,
we will leverage the password lists that are available
from SecLists with John the Ripper.
Alright, so now it's time for our first demo,
and in this demo, we will take a quick look at the syntax for John the Ripper.
We will then look at the supported ciphers that
John the Ripper is able to crack,
and we will get started with downloading a repository
of password lists from SecLists, which we will use in the course.
Alright, so now I'm in my Kali Linux machine,
and I've opened up a terminal window.
I'm going to issue the command john,
which will then give me a list of available options that's
available to use with John the Ripper.
I'm using version 1.9.0, and I'm using the jumbo release.
The jumbo release gives me the ability to leverage a lot
more ciphers that John is able to crack.
Of course, John has a man page, which is accessible using the command man john,
and this will give you a more in‑depth description of each of the
options that's available for John the Ripper.
Now let's take a look at the list of ciphers that John is able to crack.
And to do this, I'm going to issue the command john,
with the option of list, looking at the formats.
You can see from the list,
there's quite a number of hash types that are supported by
the jumbo version of John the Ripper.
Okay, so now it's time to add our password list,
and to do this, I'm going to use the list that's available from SecLists,
and this is obtainable from the GitHub repository,
and we'll take a look at how we can install this in a minute,
but I'd like to just cover a few points on this repository.
You can see that they are number of categories that's available that I can use.
Just taking a look at passwords, for example,
I've got a list of cracked hashes, leaked databases,
permutations, and a lot more.
So using this within John the Ripper will increase my chances of success.
Let's get this repository installed on a Kali Linux machine.
A quick way to do that is to open up the terminal window and
issue the command apt install seclists.
This will go out and download the entire repository onto your machine,
giving you the ability to leverage all of the password list that's available.
Once the download is completed,
you will have a copy of the repository in the usr/share/seclists folder.
To view this, you can use the command ls,
followed by usr/share/seclists,
and you'll see that we have a list of the various
categories and the password lists within each category that
we can leverage with John the Ripper.
John the Ripper makes use of wordless rules to perform
word mangling on your word list.
In essence,
it gives you the ability to create multiple additional
words based on the rule that you may have.
The wordlist rules are defined in the config file of John the Ripper.
The config file is found under the john directory in the etc folder.
Let's take a look at what this looks like.
To view the config file, we'll use the command nano,
followed by the path of the config file.
The config file might seem overwhelming at first,
but don't despair, there are tons of comments within this file,
which will give you a clear description of what each option does.
The config file of John the Ripper enables you to
configure multiple options on how John works.
One specific section that I would like to talk about is the one where you can
configure multiple options for word mangling on word lists.
I will search for the section under list.Rules Wordlist. You will
notice in this section that there is a lot of commands.
These commands are detailed on Openwall's website.
This specific rule performs permutations on a word list.
Let's try this rule on a sample word list.
I currently have a file, which is called rockyou‑05.txt. This
file has an unlimited number of passwords.
You can see the word count is only 13. To show you what's
inside, it's a very basic list of passwords.
Now let's take a look at how John can use this simple word list with
the help of the mangling rules that we've looked at the config file
to create a more complex word list.
To do this, I'm going to issue the command john,
followed by the wordlist option, which I will define my word list,
which I went to mangle.
I'm going to use the rules option,
and I'm going to define the rule called wordlist. Now keep in mind this
wordlist rule is the one that we've seen in the john.config file.
I'm going to perform a standard output,
and I'm going to pipe this into a new version of my current word list,
which I'm going to call rockyou‑v2.txt. You'll notice that the
word‑mangling process completed relatively quickly.
This is because my source word list only has 13 passwords. Of course, if you
have a much larger source word list, the time it would take to compute would
be a lot more. Now if I take a look at the files that I currently have,
let's do a word count on the new file,
which I've mangled using John the Ripper. I'm going to
issue the command word count for the new file. And you can
see right now I've got 358 words.
If I do a quick view of that file,
you will notice that now that initial basic 13‑password file
has been mangled and permutated based on the rule which was
defined in the config file.