John the Ripper is a free password cracking tool that runs on a large number of different platforms. It is one of the most used password cracking tools because it combines several other password crackers into a single package and has a number of handy features such as automatic hash type detection. Cracking password in Kali Linux using John the Ripper is very straight forward. In this post, I will demonstrate that.
John the Ripper uses a 2 step process to cracking a password. First it will use the passwd and shadow file to create an output file. Next, you then actually use dictionary attack against that file to crack it. In short, John the Ripper will use the following two files:
Cracking password using John the Ripper
In Linux, password hash is stored in /etc/shadow file. For the sake of this exercise, I will create a new user names john and assign a simple password ‘password’ to him.
I will also add john to sudo group, assign /bin/bash as his shell. There’s a nice article I posted last year which explains user creating in Linux in great details. It’s a good read if you are interested to know and understand the flags and this same structure can be used to almost any Linux/Unix/Solaris operating system. Also, when you create a user, you need their home directories created,
First let’s create a user named john and assign password as his password. (very secured..yeah!)
Now that we have created our victim, let’s start with unshadow commands. The unshadow command will combine the extries of /etc/passwd and /etc/shadow to create 1 file with username and password details. When you just type in unshadow, it shows you the usage anyway.
I’ve redirected the output to /root/johns_passwd file because I got the ticks for organizing things. Do what you feel like here.
Cracking process with John the Ripper
At this point we just need a dictionary file and get on with cracking. John comes with it’s own small password file and it can be located in /usr/share/john/password.lst. I’ve showed the size of that file using the following command.
You can use your own password lists too or download a large one from Internet (there’s lots of dictionary file in terabyte size).
Looks like it worked. So we can now use john –show option to list cracked passwords. Note that it’s a simple password that existed in the dictionary so it worked. If it wasn’t a simple password, then you would need a much bigger dictionary and lot longer to to crack it.
Now that we have completed the basics of John the Ripper and cracked a password using it, it’s possibly time to move on to bigger and more complex things. If you have any doubts regarding this post just type down a comment.