Password Cracking using John The Ripper and Johnny
0Mr. DeveloperFebruary 09, 2021
John the Ripper is a powerful and popular open-source
password cracking tool. It's known for its versatility and capability to crack
various types of password hashes through different attack methods. On the other
hand, Johnny is a user-friendly graphical interface (GUI) that makes John the
Ripper more accessible to non-technical users, simplifying the process of
password cracking.
Hello, everyone! Today, we'll demonstrate practical password-cracking examples using John the Ripper and Johnny. We'll focus on legitimate
use cases, like testing the security of your own passwords or recovering lost
credentials. Remember, always use this knowledge responsibly and ethically,
avoiding unauthorized or malicious activities. Let's get started!
John the Ripper
Let’s Start with John the Ripper:
John the Ripper is a widely used, open-source password-cracking tool that primarily focuses on cracking password hashes. It supports a variety of hash types and employs several attack modes to attempt to break passwords. It is initially developed for Unix systems, but it has since expanded to work on multiple platforms and hash types.
Features and capabilities of
John the Ripper
Let's explore the remarkable features and capabilities of
John the Ripper!
John the Ripper can handle various password hash formats,
making it compatible with different systems and databases.
It offers multiple attack modes, including brute-force,
dictionary, and hybrid attacks, providing versatile options for cracking
passwords.
John the Ripper is optimized for speed, utilizing multiple
CPU cores and GPUs to accelerate the password-cracking process.
Users can easily use their own wordlists and apply custom
rules to generate password variations efficiently.
Being an open-source tool, John the Ripper benefits from
continuous support and contributions from the vibrant cybersecurity community.
Supported Platforms and Environments
If we talk about, Supported Platforms and Environments, John
the Ripper is compatible with various operating systems, including Windows,
macOS, Linux, and other Unix-like systems.
It also works on different
architectures, making it highly versatile and widely accessible.
There is no need to install it, as John the Ripper comes
pre-installed with Kali Linux. Open a terminal and use the Help flag to take a look at its Basic Usage and
Command Syntax:
┌──(kali㉿kali)-[~]
└─$ john --help
John the Ripper 1.9.0-jumbo-1+bleeding-aec1328d6c 2021-11-02 10:45:52 +0100 OMP [linux-gnu 64-bit x86_64 SSE2 AC]
Copyright (c) 1996-2021 by Solar Designer and others
Homepage: https://www.openwall.com/john/
Usage: john [OPTIONS] [PASSWORD-FILES]
--help Print usage summary
--single[=SECTION[,..]] "Single crack" mode, using default or named rules
--single=:rule[,..] Same, using "immediate" rule(s)
--single-seed=WORD[,WORD] Add static seed word(s) for all salts in single mode
--single-wordlist=FILE *Short* wordlist with static seed words/morphemes
--single-user-seed=FILE Wordlist with seeds per username (user:password[s]
format)
--single-pair-max=N Override max. number of word pairs generated (6)
--no-single-pair Disable single word pair generation
--[no-]single-retest-guess Override config for SingleRetestGuess
--wordlist[=FILE] --stdin Wordlist mode, read words from FILE or stdin
--pipe like --stdin, but bulk reads, and allows rules
--rules[=SECTION[,..]] Enable word mangling rules (for wordlist or PRINCE
modes), using default or named rules
--rules=:rule[;..]] Same, using "immediate" rule(s)
--rules-stack=SECTION[,..] Stacked rules, applied after regular rules or to
modes that otherwise don't support rules
--rules-stack=:rule[;..] Same, using "immediate" rule(s)
--rules-skip-nop Skip any NOP ":" rules (you already ran w/o rules)
--loopback[=FILE] Like --wordlist, but extract words from a .pot file
--mem-file-size=SIZE Size threshold for wordlist preload (default 2048 MB)
--dupe-suppression Suppress all dupes in wordlist (and force preload)
--list=WHAT List capabilities, see --list=help or doc/OPTIONS
--length=N Shortcut for --min-len=N --max-len=N
--min-length=N Request a minimum candidate length in bytes
--max-length=N Request a maximum candidate length in bytes
--max-candidates=[-]N Gracefully exit after this many candidates tried.
(if negative, reset count on each crack)
--max-run-time=[-]N Gracefully exit after this many seconds (if negative,
reset timer on each crack)
--mkpc=N Request a lower max. keys per crypt
--no-loader-dupecheck Disable the dupe checking when loading hashes
--pot=NAME Pot file to use
--regen-lost-salts=N Brute force unknown salts (see doc/OPTIONS)
--reject-printable Reject printable binaries
--tune=HOW Tuning options (auto/report/N)
--subformat=FORMAT Pick a benchmark format for --format=crypt
--format=[NAME|CLASS][,..] Force hash of type NAME. The supported formats can
be seen with --list=formats and --list=subformats.
See also doc/OPTIONS for more advanced selection of
format(s), including using classes and wildcards.
┌──(kali㉿kali)-[~]
└─$
Using John the Ripper is straightforward. Just type john
followed by options and the password file,
john <options> <password-hash-file>
And you're good to go!
Johnny, a GUI for John the Ripper
John the Ripper is a widely used, open-source password-cracking tool that primarily focuses on cracking password hashes. It supports a variety of hash types and employs several attack modes to attempt to break passwords. It was initially developed for Unix systems, but it has since expanded to work on multiple platforms and hash types.
Advantages of Using Johnny over the Command-line Version
Let’s talk about the Advantages of Using Johnny over the Command-line Version:
Johnny offers a visually appealing and straightforward user
interface, reducing the learning curve for newcomers.
The GUI streamlines the configuration process, allowing
users to adjust settings without dealing with complex command-line options.
Johnny provides real-time progress updates during the
cracking process, making it easier to monitor and manage ongoing tasks.
Johnny features a wizard mode that guides users through the
necessary steps to start password cracking without requiring in-depth technical
knowledge.
The GUI may offer clearer error messages and easier
troubleshooting, enhancing the overall user experience.
Installation and Setup
Let’s talk about it’s Installation and Setup:
Johnny does not come pre-installed with Kali Linux. So we
have to install it manually. Use the following command, to download
and install the package:
┌──(kali㉿kali)-[~]
└─$ sudo apt install johnny
[sudo] password for kali:
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages were automatically installed and are no longer required:
0 upgraded, 1 newly installed, 0 to remove and 852 not upgraded.
Need to get 541 kB of archives.
After this operation, 923 kB of additional disk space will be used.
Get:1 http://http.kali.org/kali kali-rolling/main amd64 johnny amd64 2.2+git20160807-0kali2 [541 kB]
Fetched 541 kB in 18s (30.9 kB/s)
Selecting previously unselected package johnny.
(Reading database ... 400753 files and directories currently installed.)
Preparing to unpack .../johnny_2.2+git20160807-0kali2_amd64.deb ...
Unpacking johnny (2.2+git20160807-0kali2) ...
Setting up johnny (2.2+git20160807-0kali2) ...
Processing triggers for kali-menu (2023.2.3) ...
┌──(kali㉿kali)-[~]
└─$
With Johnny successfully installed, you can launch it
effortlessly. Simply locate Johnny in your application menu and click on it.
As
you do, the intuitive GUI interface of Johnny will open up, ready for use.
Components and Functionalities
Now,
let's delve into its various components and functionalities. The user interface of Johnny typically consists of the
following components:
Open Password File:
This section is used to load password files.
There are two
segments: one for hash files, and the other for password-protected files like
ZIP, PDF, and rar files.
Once loaded, they will be displayed in the highlighted
area.
Option Tab:
Under the Options Tab, you'll find two sections: Session
Detail, and Attack Mode.
Let's explore them further.
Session Detail:
Here, you can provide the current password hash format in
the input box. It defaults to a standard format, but you can adjust it if
needed.
Attack Mode:
You can select the attack type from options like single
crack, wordlist, incremental, external, mask, Markov, and Prince.
Among them the Wordlist tab is particularly important; it
lets you input your custom wordlist.
Console log:
This area displays logs for each attack
attempt, providing insights into the cracking process.
Start, Resume, and Pause Attack Buttons:
These buttons
initiate, resume, or pause the password-cracking process, giving you control
over the operation.
Progress Bar:
The progress bar offers a visual
representation of the cracking progress, making it easy to track.
Explain with Examples:
Let’s explain John the Ripper and Johnny using some
Examples:
Example 1: How to Crack Any Type of Hash?
To initiate the process of cracking any hash, we must first
obtain it. Hashes can adopt various formats, such as MD5, SHA, and others.
Let's generate a hash using a hash generator and store it in a text file. To generate a hash, we can utilize online hash generator
tools.
For this illustration, let's generate an MD5 hash.
In the
input field, input your desired string and after clicking the "Generate"
button, you'll be presented with a range of hash formats.
Focus on copying the
MD5 hash and, save the MD5 hash to a text editor and designate the
file as "hashmd.txt."
With the hash file prepared, we are ready to
proceed with the cracking process. To crack the password using John the Ripper, execute the following format:
john --format=<specify-hash-format><specify-hash-file>
Now, run the command on the terminal:
┌──(kali㉿kali)-[~]
└─$ sudo john --format=Raw-MD5 hashmd.txt
John the Ripper will try to crack the hash and reveal the
password if successful.
This guide provides step-by-step instructions on how to generate wordlists for password cracking. Wordlists are essential tools for security professionals and ethical hackers to test and strengthen password security.
The hash I've generated isn't present within the
pre-installed wordlists on Kali Linux. Hence, the need arises to generate our
custom wordlist using CUPP.
Upon completion of Cupp Interactive, you'll be furnished with a
well-suited wordlist.
With the wordlist prepared, we can now proceed to apply
it with John the Ripper. Run, john with the following format:
john --format=<specify-hash-format><specify-hash-file> --wordlist=<specify-wordlist>
Run it on the terminal:
┌──(kali㉿kali)-[~]
└─$ sudo john --format=Raw-MD5 hashmd.txt --wordlist=techno.txt
Use the "--show --format=PDF" options to display all of the cracked passwords reliably
Session completed.
┌──(kali㉿kali)-[~]
└─$
Once the password is cracked, we can view
its content effortlessly.
Example 4: How to Crack a Linux Password?
In this example, we'll explore how to crack Linux passwords:
The process involves obtaining the "/shadow" and "/passwd" files from the "/etc" directory. For demonstration purposes, I've set up three new users on my Ubuntu
system to see if John the Ripper can crack their passwords.
To begin, boot your system using a Kali Linux USB drive. If
you're unsure about creating a portable USB drive, you can refer to our video
guide for assistance.
Kali Linux is a distribution of Linux that is specifically designed for penetration testing, digital forensics, and other security-related tasks. A "Live" version of Kali allows the user to boot the operating system from a USB drive, rather than installing it on a computer's hard drive.
Once the system is booted, we need to retrieve the shadow
and passwd files from the Ubuntu Hard disk using the unshadow command-line tool.
Open Ubuntu Linux hard disk, and navigate
to the "/etc" directory:
Open a terminal from here, and execute the following command:
sudo unshadow then mention, passwd, and shadow file, and here, specify the destination location as /Desktop.
This process can be time-consuming due to the limited power of John the
Ripper's built-in wordlist. To enhance our chances, let's utilize a
pre-installed wordlist.
For this purpose, we will use rockyou.txt. First, locate the path of rockyou.txt and if this file
is in ".gz" format, we have to extract it using gunzip.
With the wordlist in place,
we'll run John using this wordlist.
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo john --format=crypt linuxpass.txt --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 4 password hashes with 4 different salts (crypt, generic crypt(3) [?/64])
Cost 1 (algorithm [1:descrypt 2:md5crypt 3:sunmd5 4:bcrypt 5:sha256crypt 6:sha512crypt]) is 0 for all loaded hashes
Cost 2 (algorithm specific iterations) is 1 for all loaded hashes
Press 'q' or Ctrl-C to abort, almost any other key for status
password (user3)
1234 (ubuntu)
Thanks to the enriched wordlist, we've been able to
successfully crack two passwords. This underscores the impact of using a more
potent wordlist in the password-cracking process.
Example 5: How to Crack Windows Password?
In this scenario, I'm working with a Windows machine. For
the purpose of demonstration, I've established two new user accounts.
The goal
is to assess whether John the Ripper is capable of cracking the passwords
associated with these user accounts.
It is always important to know that,
Windows stores user account
passwords in a file called the Security Account Manager (SAM) file.
To crack Windows SAM file passwords, we need to obtain the
SAM and SYSTEM files from the Windows system. To get started, boot your system
with a Kali Linux USB drive.
Open the Windows Hard Disk, navigate to the Windows drive → Windows → System32 → config directory.
The next step involves copying and converting the extracted
hashes into a format that John the Ripper can comprehend. To do this, we will use
the samdump2 command.
Open a terminal from here, and execute the following command to Kali home directory:
Warning: passwords printed above might not be all those cracked
Use the "--show --format=NT" options to display all of the cracked passwords reliably
Session completed.
┌──(kali㉿kali)-[~]
└─$
John the Ripper will automatically begin the process of
cracking Windows passwords.
Conclusion
In conclusion, John the Ripper stands out as a robust
open-source password-cracking tool, proficient in cracking diverse password
hashes using multiple attack methods. On the other hand, Johnny presents a
user-friendly graphical interface that streamlines the utilization of John the
Ripper, making password-cracking tasks more approachable for users of all
levels.
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
