Chapter 5

John the Ripper

Now that we have covered a lot of the basic of password theory and an understanding of wordlists, let’s dig into cracking tools! In the next several chapters we will look at two of my favorites, John the Ripper & Hashcat. We saw that sometimes you can just do an online hash lookup, and in some cases, you can pass the hash. But if all else fails, you have to crack the hash. Kali includes several excellent tools to do this. We will quickly cover John the Ripper in this chapter, then dive deep into Hashcat in the upcoming chapters.

Introduction to Password Cracking Tools

We rely on passwords to secure our home systems, business servers and to protect our online account information. But as cracking programs improve and video cards get faster (Video GPU’s are used for very fast cracking) passwords are becoming much easier to crack. How big of a problem is this? I have been working through some very large publicly dumped password hash lists using Hashcat. I use an older Windows 11 system that has a Core i7-6700 processor running at 3.4 Ghz and a single RTX 2060 video card. I’ve seen it hit cracking speeds over 1 billion hashes a second. When you think about that, it is insane! And that was just with using a single video card. The newer top end cards are a lot faster, especially when you use multiple cards for cracking (I’ve seen rigs with numerous cards).

Granted these were simple SHA1 encrypted hashes, hashes using newer encryption or salted passwords would take a lot longer to crack. A salted...

John the Ripper

Tool Author: Solar Designer and community

Tool Website: https://www.openwall.com/john/

John the Ripper, or John (or JTR) is a very fast CPU based password cracker. It is very easy to use and is often the first tool used when trying to crack a password. John is very good at getting shorter passwords, so I usually use John first, to get the low hanging fruit or easier passwords, and then move to Hashcat for more complex cracking. As such, we will only quickly cover John.

John the Ripper Overview

John the Ripper is an open-source password cracking software that is widely used for penetration testing, ethical hacking, and forensic analysis. Developed by Solar Designer, the tool has become a staple in the cybersecurity community due to its effectiveness and flexibility.

Password Hash Cracking

John the Ripper excels in cracking password hashes of all types. It supports hundreds of hashes and ciphers, including DES, MD5, SHA-1, SHA-256, Bitlocker, Archives (ZIP, RAR) and more. This versatility makes it suitable for handling a wide range of both Offensive Security and Forensics uses.

Wordlist and Hybrid Attacks

John supports dictionary attacks using wordlists, allowing users to leverage commonly used passwords or create custom lists based on specific criteria. Additionally, it can perform hybrid attacks, combining wordlists with brute-force methods to increase the chances of success.

Multi-platform Support

John the Ripper is platform-independent, running on...

John the Ripper in Action

John is really easy to use, you just type “john” and the password file to crack and John takes off running. John will attempt to automatically detect the hashes from the password file. If it can’t it will prompt you to enter the correct encryption format using the “--format=” command. The following screenshot is an example of cracking a large SHA1 password dump using John:

➢      john [password_hash_list] --format=Raw-SHA1

As I mentioned earlier, for a CPU based cracker, John is fast. In the example above, I fed John a list of over 16 million hashes. It found over 2 million of the passwords I was trying to crack in about 15 minutes. After that, it just spun its wheels with no real progress. At this point I could have used some of John’s more advanced features to crack the list, but instead I moved on to Hashcat.

When you do crack a password hash file, any credentials that are recovered are stored...