In this tutorial, we will delve into the world of password cracking with John the Ripper. This comprehensive guide will provide you with a complete understanding of what John the Ripper is, why it is used, and how it works. We will also cover the installation process for various operating systems such as Windows, Linux, and macOS.

The tutorial will then move on to the various password cracking modes that John the Ripper provides, including Single Crack Mode, Wordlist Mode, and Incremental Mode. We will also explain how to configure John the Ripper to suit your specific needs and how to launch a password cracking attack.

By the end of this tutorial, you will have a solid understanding of how to use John the Ripper to perform password cracking attacks, interpret the results, and improve the security of your systems. Whether you are a security researcher, penetration tester, or just interested in learning more about password cracking, this tutorial is for you. So, let’s get started!

What is John the Ripper?

John the Ripper is a popular password cracking tool used to perform password cracking attacks on various operating systems such as Windows, Linux, and macOS. It is a fast, flexible, and free open-source tool designed for cracking passwords and testing the security of a system.

Why use John the Ripper?

John the Ripper is widely used by penetration testers, ethical hackers, and security researchers to test the security of their systems and identify vulnerabilities. By cracking passwords, they can determine if they are strong enough to withstand an attack or if they can be easily cracked by a hacker. Additionally, John the Ripper can help in resetting forgotten passwords, recovering lost or stolen passwords, and improving the overall security of a system by enforcing strong password policies.

Installation of John the Ripper

System Requirements

Installing on Windows

To install John the Ripper on Windows, follow these steps:

1. Download the ZIP file of John the Ripper from the official website.
2. Extract the contents of the ZIP file to a folder on your computer.
3. Open the Command Prompt and navigate to the folder where you extracted John the Ripper.
4. Run the “john.exe” file to launch John the Ripper.

Installing on macOS

To install John the Ripper on macOS, follow these steps:

1. Install Homebrew, a package manager for macOS, by running the following command in your terminal: /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"
2. Run the following command in your terminal to install John the Ripper: brew install john-jumbo
3. Once the installation is complete, you can launch John the Ripper by running the “john” command in your terminal.

Installing on Linux

To install John the Ripper on Linux, follow these steps:

1. Open your terminal and run the following command to install the required dependencies: sudo apt-get update && sudo apt-get install build-essential libssl-dev zlib1g-dev
2. Download the source code of John the Ripper from the official website.
3. Extract the contents of the downloaded archive.
4. Navigate to the extracted folder in your terminal.
5. Run the following commands to compile and install John the Ripper: ./configure make sudo make install
6. Once the installation is complete, you can launch John the Ripper by running the “john” command in your terminal.

Note: The specific steps may vary depending on the operating system you are using and the version of John the Ripper you are installing. Please refer to the official documentation for the latest and most accurate instructions.

Understanding John the Ripper’s Password Cracking Modes

Single Crack Mode

Single Crack mode is ideal when you have a specific password in mind and want to verify if it matches the target password hash. This mode is quick and efficient as John only needs to perform one comparison. However, if the password you specify is incorrect, you’ll need to run the cracking process again with a different password, which can be time-consuming.

Wordlist Mode

Wordlist mode is suitable for cracking passwords that are commonly used or can be found in a dictionary. The wordlist file contains a list of such passwords, and John compares each password from the list with the target password hash. This mode is faster than the incremental mode, but its success rate depends on the quality and size of the wordlist used. If the target password is not included in the wordlist, John will not be able to crack it.

Incremental Mode

Incremental mode is the most comprehensive mode of password cracking in John the Ripper. It generates all possible combinations of characters, numbers, and symbols, and compares each generated password with the target password hash. This mode is highly effective in cracking complex passwords, but it is also the slowest mode. The time required to crack a password using incremental mode depends on the length and complexity of the password, and the power of the computer being used.

In summary, John the Ripper’s password cracking modes offer different trade-offs between speed, success rate, and complexity. Single Crack mode is quick and efficient, but its success rate is limited. Wordlist mode is faster than incremental mode, but its success rate depends on the quality and size of the wordlist used. Incremental mode is the most comprehensive, but also the slowest mode.

Configuring John the Ripper

Setting the Password File

In order to launch a password cracking attack with John the Ripper, you must first specify the password file you want to crack. The password file is a file that contains the hashes of the passwords you want to crack. To set the password file, use the following command: john --wordlist=path/to/wordlist.txt --rules --stdout > hashes.txt

• “john” is the name of the executable file that launches John the Ripper.
• “--wordlist=path/to/wordlist.txt” specifies the path to the wordlist file that will be used in the password cracking attack. The wordlist file contains a list of words that will be used to guess the passwords.
• “--rules” tells John the Ripper to apply rule-based mangling to the words in the wordlist. Rule-based mangling is a technique used to modify words in the wordlist to generate additional candidate passwords.
• “--stdout” tells John the Ripper to write the generated hashes to the standard output.
• “> hashes.txt” redirects the output of the command to a file named “hashes.txt”. This file will contain the hashes that will be used in the password cracking attack.

Setting the Hash Algorithm

John the Ripper supports a wide variety of password hash formats. Some of the more commonly used formats include:

• NTLM
• MD5
• SHA-256
• SHA-512
• bcrypt
• DES-based crypt
• FreeBSD-style Blowfish-based crypt

To use one of these formats in John the Ripper, you would use the “--format” option followed by the name of the format. For example, to use the NTLM format, you would run the following command:

john --format=ntlm hashes.txt

Note: This is just a small sample of the formats supported by John the Ripper. Please refer to the official documentation for a complete list of supported formats and how to use them.

Setting the Configuration File

John the Ripper can be configured using a configuration file to specify the options and settings you want to use. To set the configuration file, use the following command: john --config=path/to/john.conf hashes.txt

Here is an example of a basic configuration file for John the Ripper:

# John the Ripper configuration file

# Set the default hash type
default_format = raw-sha256

# Set the wordlist file
wordlist = path/to/wordlist.txt

# Enable rule-based mangling
rules = yes

# Set the number of password cracking threads
fork = 4

# Set the maximum password length
max_length = 20

Note: The specific syntax and options may vary depending on the version of John the Ripper you are using and the operating system you are using. Please refer to the official documentation for the latest and most accurate information.

Launching John the Ripper

Launching in Single Crack Mode

In single crack mode, John the Ripper tries to crack a single password using a specified wordlist. To launch John the Ripper in single crack mode, use the following command:

john --single --format=ntlm hashes.txt

Replace “path/to/wordlist.txt” with the path to your wordlist file, and “ntlm” with the desired hash format. The “hashes.txt” file contains the hashes of the passwords you want to crack.

Launching in Wordlist Mode

In wordlist mode, John the Ripper tries to crack multiple passwords using a specified wordlist. To launch John the Ripper in wordlist mode, use the following command:

john --wordlist=path/to/wordlist.txt --rules=all --format=ntlm hashes.txt

Replace “path/to/wordlist.txt” with the path to your wordlist file, and “ntlm” with the desired hash format. The “–rules=all” option tells John the Ripper to apply all available rule-based mangling to the words in the wordlist. The “hashes.txt” file contains the hashes of the passwords you want to crack.

Launching in Incremental Mode

In incremental mode, John the Ripper tries to crack multiple passwords using a specified set of characters and a set of rules to generate candidate passwords. To launch John the Ripper in incremental mode, use the following command:

john --incremental=alpha hashes.txt

Replace “alpha” with the desired set of characters, and “hashes.txt” with the file containing the hashes of the passwords you want to crack. The “–incremental” option tells John the Ripper to use incremental mode and the specified set of characters to generate candidate passwords.

Note: The above commands are just examples and may need to be modified depending on your specific use case. Please refer to the official documentation for more information on the various modes of operation and how to use them.

Understanding the Output Of John The Ripper

Cracked Passwords

When John the Ripper successfully cracks a password, it will display the cracked password along with the corresponding username or hash. For example:

username:password

Progress Report

John the Ripper provides a progress report while it is cracking passwords. The progress report displays the number of passwords tried, the number of passwords cracked, and the estimated time remaining. For example:

1g 0:00:03:07 100.00% (2)

In this example, the “1g” indicates that John the Ripper is currently running at its first guess rate, the “0:00:03:07” is the estimated time remaining, and the “100.00%” is the percentage of the wordlist that has been processed.

Speed of Cracking

The speed of cracking passwords with John the Ripper is dependent on several factors, including the length and complexity of the passwords, the size of the wordlist, and the power of the computer running John the Ripper. To get a rough estimate of the speed of cracking, you can look at the progress report provided by John the Ripper. For example, if the estimated time remaining is “0:00:03:07”, then John the Ripper is cracking passwords at a rate of approximately 3 minutes and 7 seconds per password.

Note: The above examples are just a general representation of the output from John the Ripper and may vary depending on the specific use case. Please refer to the official documentation for more information on the output from John the Ripper and how to interpret it.

Conclusion

John the Ripper is a powerful password cracking tool that can help security professionals and penetration testers uncover weak or easily guessable passwords. The tool is simple to install and configure, and offers a variety of attack modes to maximize the chances of cracking passwords. With the understanding of its various options and configuration parameters, one can use John the Ripper effectively to test the security of their own systems or to gain access to systems with permission.

It is important to note that password cracking should only be performed in a controlled environment with proper authorization, and should never be used for illegal or malicious purposes. By following ethical and responsible practices, John the Ripper can be a valuable tool for enhancing security and protecting against security threats.