John The Ripper – One Stop Password Audit Tool

John The Ripper – A one stop password audit tool for various formats

John is a state of the art offline password cracking tool. John was better known as John The Ripper(JTR) combines many forms of password crackers into one single tool. It automatically detects the type of password & tries to crack them with either bruteforceing the encrypted hash or by using a dictionary attack on it.

JTR supports It can be run against various encrypted password formats including several crypt password hash types most commonly found on various Unix versions (based on DES, MD5, or Blowfish), Kerberos AFS, and Windows NT/2000/XP/2003 LM hash.

Additional modules have extended its ability to include MD4-based password hashes and passwords stored in LDAP, MySQL, and others.

Pentesters use JTR to check the password complexity assuring a dictionary attack is not possible on the system under test. As JTR is an offline tool, one has to get(steal) the password containing files from the target system. Johnny is the GUI mode of JTR.

Options

The file menu is used for opening hash-dumped or the encrypted password file & to change sessions.

Attack menu deals with attack options(Start/Stop/Pause)

On the left pane, 4 options are there.

• Passwords tab shows the currently loaded users & their encryption details from the file loaded.
• Options tab helps you to tune how john works to crack the password. (Default, Incremental, Wordlist mode etc)
• Statistics tab shows the current statistics once the attack has started.
• Settings allow you to edit the main settings for the john engine like the path to the binaries, timing etc.
• Output tab shows the result of the attack once passwords get cracked.

John Homepage: http://www.openwall.com/john/

Lab 1: Break Weak Unix password

In this lab, we’ll look at breaking a week Unix password. For that first, we have to understand the files containing the authentication information. In unix/linux “passwd” file located at /etc/passwd contains all user information. “shadow” file located at /etc/shadow contains the SHA encrypted password of each of the users found in passwd file.

For this lab, we have a passwd & shadow file from a remote system stolen with other tools (explained within this series) located in the Desktop folder.

Step 1: Combine the passwd & shadow file to one file named crack

Command : cat /etc/passwd > Desktop/crack && cat /etc/shadow >> Desktop/crack

Then try reading the files individually with any text editor you like(leafpad, nano, vim, or simply cat it). The above command reads the content of passwd file into a new file named crack and then reads & appends the contents of the shadow file into the crack file.

In the above image, the highlighted section indicates the end of passwd file & beginning of shadow file.

Step 3: Load it to Johnny

Step 4: Click start attack to start the attack!

Step 5: Return to the Passwords tab and see the password

Note: Sometimes the auto detect option in the options tab doesn’t work. If so use the exact type of format. In Unix it is a SHA512 crypt. So use Crypt format. Also the time it takes to crack the password hashes depends on its complexity.

So don’t hesitate to make your passwords as complex as possible!

Windows NTLM Comming Soon…!

Read More on shadow file