John the Ripper - Hash Cracking Tool
John the Ripper is a well-known hash-cracking tool. The main advantage of John is fast cracking speed and a huge list of compatible hash types.
Why cracking is hard
While creating a hash is not particularly hard, un-hashing (reversing) the algorithm is a problem in NP. John uses a dictionary and creates hashes based on it. Then it compares each result with the inserted hash, and if it's a match - we cracked it!
The most popular extended version of John is Jumbo John.
Basic syntax
The basic syntax for John is:
john [options] [file paths]
John can also autodetect which hash is used. Although it's not always the most reliable way (there are better tools, e.g. hash-id.py), here's the structure:
john --wordlist=[path] [path to file]
If we already identified the hash, we can use the option --format=[format]. Ex: --format=raw_md5
There's a list of available hashes: john --list=formats
John also allows us to hack Windows SAM (NTHash).
Cracking /etc/shadow
To crack /etc/shadow we can use the built-in tool called unshadow:
unshadow [path to passwd] [path to shadow]
Note: modern Linux uses sha512crypt.
Single Crack mode
Another mode John has is Single Crack mode - it uses the username to guess the password, by slightly changing the letters and numbers contained within the username (this technique is called mangling).
john --single --format=[format] [file path]
Note: We have to change the format of the file that we feed to John for him to understand it:
data:hash
where data could be a login or any data that he can mangle with.
Custom rules
We can also create custom rules, predicting the specific pattern of the password. For example, we can exploit the fact that most people will use the first symbol in upper case and the last symbol as a special symbol in password complexity checks. This is called password complexity predictability.
To create custom rules:
/etc/john/john.conf
The first line is:
[List.Rules:Name] - defines the name
then we use regex patterns:
Az - appends the word with the symbol we define
A0 - prepends the same
c - capitalizes the character positionally
Example:
cAz"[0-9] [!£$%@]"
The first character is capitalized, and the word is followed by a number and a symbol.
Lastly, we can call this rule using the --rule=[rulename] option.
Cracking archives and SSH keys
John also allows us to crack password-protected zip files:
zip2john [options] [zip path] > [output file] - converts the zip file into a hash format John can understand.
The same goes for RAR files:
rar2john [options] [rar path] > [output file]
Additional use of John is cracking the id_rsa file for SSH key-based authentication:
ssh2john [id_rsa private key file] > [output file]
Further steps are the same as before. John allows us to crack hashes fast, right inside our terminal.