Cracking Passwords Using John the Ripper

https://stealthsecurity.io/cracking-passwords-using-john-the-ripper-977943d7ab38

by manishmshiva • 4 years ago

66 29 4 years ago

John the Ripper is a password-cracking tool that can crack hundreds of hashes, ciphers, and even password-protected files.

Thaxll• 4 years ago

If you want to use state of the art password cracking: https://hashcat.net/hashcat/

uniqueuid• 4 years ago

And combine that with rainbow tables where appropriate :)

Cupprum2• 4 years ago

Rainbow tables are still being used?

RajT883• 4 years ago

Hashcat is unbelievable!

On a lark, I tried to crack my own WPA key for my local network. Captured the handshake, downloaded some wordlists, started it. I have an older CPU and graphics card, i7 4930k + GTX 1060.

Some regular CPU based method, I ran the numbers and figured it would take a bit over a week. Ran it for a day, and then decided to see if something better was available.

Read about Hashcat, gave it a go, and it finished in 90 minutes. At first, I thought I made a mistake and it crapped out, but nope! It cracked it. It was done. 90 minutes on modest hardware. Imagine if you invested some real money in it with a modern system!

psychphysic3• 4 years ago

Dictionary or brute force?

If it's brute force that's astounding.

no-dr-onboard• 4 years ago

I've had mixed results. For some formats (NTLM, SHA, OpenSSH, IKE, etc), John seems to be better just out of the box. I've compared it to Hashcat with a spefied format, mask, and tune. For whatever reason, 50% of the time, John runs significantly faster without any arguments.

LennyWhiteJr• 4 years ago

Man, I remember running this and ophcrack as a 15 year old to recover the windows login password for my mom's computer after she forgot it. She was convinced her password had just stopped working, until I recovered it and she realized that she just forgot what it was lol.

frgtpsswrdlame• 4 years ago

Haha yes, my parents put a password to keep me from playing WoW on the family computer. When I used ophcrack to get the password they were mad (but I think a little impressed.)

user3939382• 4 years ago

There used to be this site hackers.com that had all these types of tools on it, including this one, which is where I discovered it. I was awestruck as a kid.

psychphysic3• 4 years ago

I was a big fan of hackthissite.org and hellboundhackers.org

origamiPyro2• 4 years ago

Why is this account-walled blogspam getting upvotes? Haven't read it because I'm not making an account.

There's no indication from the post that there's any more value to this article than simply reading the docs about a well known tool.

origamiPyro2• 4 years ago

I have now read this article and skimmed the authors blog. They're all reproductions of a basic documentation pages. Every single one is submitted to hacker news including a tutorial on writing a while loop in python.

gnuvince• 4 years ago

That's a program name that I haven't heard in a while and which brings back memories :D

When I was a teenager, sometimes around 1996 or 1997, I watched the movie "Hackers" for the first time and my immature mind was immediately drawn to the idea of using computers to sneak into places you weren't supposed to. (The pretty graphics helped too.) I went online and I found an early version of John The Ripper and thought "yes, this is exactly what I want!" It would be a few years before I even learned what Unix and /etc/passwd were, but it felt so cool to have a real hacking tool on a floppy disk.

smallnix• 4 years ago

Same for me but with the SubSeven RAT.

fcatalan• 4 years ago

I was in college in 96. Email accounts were only for some limited staff and foreign students, but we all wanted one. I managed to get hold of one, with console access, because the mail interface was elm.

I downloaded the passwd file and took it home to crack a few passwords, intending to take over accounts that were unused.

Jack the Ripper beeped loudly every time a match was found. I had it running for hours, with the occasional beep, but suddenly the PC started beeping like crazy for a good minute. Turns out that the default password was no password at all, you'd set it up on the first login.

It had found a big bunch of accounts created and never used, so me and my friends had struck gold.

Even when we were inevitably caught it wasn't a big deal: Some "don't be naughty boys" over a few beers.

Simpler times.

ravenstine• 4 years ago

You might also remember a pretty awesome tool called Cain and Abel that not only did hash cracking but also revealed all sorts of passwords stored on Windows including the user passwords and credentials used in Internet Explorer. As an adolescent, Cain was like God Mode for Windows. Boy did I have a lot of fun using it to mess with school computers! I did nothing seriously harmful, but pulled relatively harmless pranks. Though I did once use it to get the FTP password to someone's site and defaced it with a meme, but I soon reversed it because I felt guilty. :P

dementis3• 4 years ago

It's important to always remember to salt your hash or you will get attacked by rainbows.

Cracking passwords based on their hash has been a known attack for a long time, here is a web page from 2007 that talks about rainbow table attacks.

https://blog.codinghorror.com/rainbow-hash-cracking/

lasermike026• 4 years ago

Now that's a name I haven't heard in a long time... long time.

ncrmro• 4 years ago

I’ve been trying to unlock two timemachine backups I forgot the passwords to.

Never quite got the hang of using John the ripper.

1letterunixname• 4 years ago

Roughly 1999-2006 a University of California CS department, the *nix clusters used NIS+ for login.

I ran something like: getent passwd | johntheripper and it found roughly 40 passwords in 60 seconds, including tenured profs and primary investigators.

I also downloaded a torrent of rainbowtables from some schm00 folks (when it was available) and found other passwords.

PS: JTR is a product of the w00w00 group.

Cracking Passwords Using John the Ripper

Related Stories