‫John the Ripper is a fast password cracker currently available for many flavors of Unix, windows,
‫doors and open VMS initially developed for the Unix operating system, it now runs on 15 different platforms.
‫It's one of the most popular password testing and breaking programs as it combines a number of password
‫crackers into one package autodidacts, password hash types and includes a customizable cracker.
‫John, the river is free and open source software distributed primarily in source code for.
‫If you'd rather use a commercial product tailored for your specific operating system, please consider
‫John the Ripper pro.
‫Which is distributed primarily in the form of native packages for the target operating systems and in
‫general it's meant to be easier to install and use while delivering optimal performance.
‫Now, there is another version of John, which is the community enhanced version, this version integrates
‫lots of contributed patches, adding GPU support, open S.L and Cutaş for a hundred of additional hash
‫and cipher types, including popular ones such as NLM, Raw, AMD, five cetera, and even things such
‫as encrypted Open SSA, private keys, ZIP and RJR archives, PDF files, etc..
‫As well as some optimisations and features.
‫So let's see, John, the river in action.
‫Official free and open source version of John the Ripper is embedded in Colly.
‫If you type John with no parameter, you'll see the manual page of the tool, you see the usage and
‫all the options of John.
‫Let's build an offline dictionary attack with John.
‫The first parameter is wordlist, don't forget to put the equals sign after the parameter.
‫Name of the dictionary file with a full path comes here.
‫So I'll open another terminal screen and search for a password list using the fine common.
‫Now, there is a folder called Word Wordlist under the Métis Boyte framework folder.
‫Let's go to that folder to see it content.
‫And there are a lot of word lists here for different purposes right now.
‫I want to look at the length of the password list file.
‫Cat password, dot elstein, pipe W, C for word count, the first one is the number of lines and the
‫second one is a number of words, which is the same with a line numbers.
‫And the third one is the number of characters.
‫So there are about 90000 passwords in this list.
‫Obviously, the fire with less command.
‫You can search a word inside the last command by pressing the button, so I'll search for the password
‫of the administrator, no result.
‫MSF admin now Resul.
‫So note here that these steps are just to have successful result in a typical penetration test, you
‫won't know the passwords of the victim systems.
‫Beyond that, if you already know the password of the victim, well, what's the reason for adding it
‫to a dictionary and then finding it again?
‫Suppose that these steps never happen and the words were already in the list were used, right?
‫Now, I'll open the dictionary and add a few words, so I'll repeat that we're just supposing that the
‫process never happened and the words were already in the list.
‫But I just want to show you the mechanics of it.
‫So now we can use this list as the word list in John.
‫So write the file name with the full power.
‫The second parameter is the hash file.
‫Now, I'll run the command, adding no more parameters for.
‫So if you don't specify the hash pipe John detects itself, it detected the hash type as Elim and warns
‫us about the NTE hash.
‫And here are the result.
‫Guest password is empty, it also shows the first part of the administrators hash and the second part
‫of cyber labs hash and as you see here in all uppercase letters.
‫Now, you'll recall the latest command and ad the format parameter is empty this time and hit enter.
‫Here are the results.
‫Now we see all the letters in their own formats, upper case or lower case?
‫So now I want to try to crack the Windows eight hashes.
‫So I'll give you a hash vial of the Windows eight system this time.
‫I removed the format parameter and run the command, John reckons the hashes as L.M. and got no result.
‫So let's give the hash format.
‫Now we have a result.
‫Password of Uttam user is Urabe 12, but wait a sec.
‫When he was eight as a user with the password, one, two, three, four, QQQ uppercase Q and DOT,
‫which is the same with the password of the administrator user of Windows XP.
‫We know that the word is in the dictionary, so why couldn't John crack it?
‫Well, the answer is inside the John that pot file, so let's find his location using the Find Lennix
‫command.
‫And let's see the content of the file with the cat command.
‫So, John Storrs, the findings in John Negroponte file with the hash format, and if it finds the same
‫hash with the same format, it doesn't try to crack it again.
‫So you should look at the John, that Potti file for the hashes you try to crack with John.
‫Right.
‫So if we were on the latest command, again, it won't crack any hash because they've all been cracked
‫before.
‫So if you delete the johnboat part file.
‫And run the latest command again, you'll see all the crack results of the hash file.
‫Good.
‫Let's move on and try to crack the hashes of the medicine, voidable Linux VM.
‫Now the hash file is hash, M-2, dot text and don't give the format parameter.
‫I'll let John detect the hash type and hit enter.
‫So it detected the harsh type as 95 creped, and that's correct.
‫So look at that, we cracked password, the passwords of the Métis employable users are not so complicated,
‫are they?
‫So look at the John Pottuvil once more.
‫And now you see the new hash is stored with hash type one where one stands for MDVIP.
‫Excellent.