Every self-respecting pentester should have a powerful password cracker in their toolkit, and John the Ripper is simply the best cracker out there.

Initially released in 1996 by Openwall, John the Ripper has grown to become the preferred password cracker for hackers and pentesters and a reliable tool used by auditors to spot weak passwords.

In this article, we will learn how to perform basic password cracking using John the Ripper.

Why Use John The Ripper?

John the Ripper is an offline password cracker. In other words, it tries to find passwords from captured files without having to interact with the target. By doing this, it does not generate suspicious traffic since the process is generally performed locally, on the attacker’s machine.

Although it’s primarily used to crack password hashes, John can also be used to crack protected archive files, encrypted private keys, and many more.

How to Download John The Ripper?

John the Ripper is a free open-source project. You can download it for free from the Openwall website or from its official Github repository. You should make sure to download the correct package for your OS.

If you have Kali Linux, then john should already be installed. You can find the correct location of the binary file by running the locate command

locate john

Getting Started

Once you’ve successfully downloaded and installed John, you can launch it by typing the name of the binary file on your command prompt followed by a password file.

In the below example, passwordFile is a file that contains a list of password hashes that we want to crack.

./john passwordFile

This is the most basic command that you can use. Since we have not specified any parameter other than the password file, John will try to crack this file using the default options.

Although this is the simplest and easiest way to use John, it will not necessarily provide the desired results. For this, we have to specify additional options.

John’s Cracking Modes

When attempting to crack a password file using John the Ripper, the first thing you need to consider is how should John go about performing the cracking process.

John has three main cracking modes that you can choose from. Let’s see what each of these modes does.

Wordlist Mode

This is the most common way to use John the Ripper. In this mode, you can specify a path to a wordlist file that contains a list of possible passwords. John will test all the words contained in that wordlist and check if the correct password is present there. This process is what is known as a Dictionary Attack.

It is important that the wordlist contains one password per line. Otherwise, John the Ripper will not process it correctly.

In the example below, I am using the ‘–wordlist‘ option to specify the path to the wordlist file, which is ‘/usr/share/wordlists/rockyou.txt‘. If the correct password is in that file, John will display it.

./john --wordlist=/usr/share/wordlists/rockyou.txt passwordFile

‘passwordFile‘ is the text file that contains the password hashes that we want to crack.

To increase the chances of finding a correct password, you can enable the wordlist mode with mangling rules. By doing this, John will slightly modify each word in the wordlist. This will result in new likely passwords that aren’t necessarily present in the wordlist, and thus it will increase your chances of finding the correct one.

To enable mangling rules, you can use the ‘–rules‘ option. However, you should note that this will take a longer time to process the wordlist.

Single Crack Mode

The single crack mode is generally used when trying to crack Unix passwords. It takes advantage of the GECOS fields present in the passwd file. These GECOS fields normally contain information about the user, such as their username and their full name.

John will generate a list of candidate passwords from these fields, and by using an extensive set of mangling rules (which John does by default in the single crack mode), the generated list will be customized to each user.

To enable Single Crack mode, you can simply use the ‘–single‘ option.

You should note that, when no mode is specified, John by default starts with single crack mode, then the wordlist mode, before ending with the incremental mode (which we’ll see in the coming section).

To better illustrate this mode, let’s see an example of how you would crack the passwords of a Unix system.

Example

The classical password file where Unix systems store information about users is ‘/etc/passwd‘. However, almost all Unix systems store password hashes in a separate file ‘/etc/shadow‘.

Now, in order to have a single file with GECOS fields and password hashes, we can use the ‘unshadow‘ utility that comes with John.

You can do so by running the following command:

unshadow /etc/passwd /etc/shadow > passwordFile

The above command will save the generated file in the current directory under the name ‘passwordFile‘.

Once we have our password file, we can run John with the single crack mode.

./john --single passwordFile

Incremental Mode

This is John’s brute force mode. When enabled, John will try every possible combination of characters within the specified charset and password length limit.

To enable the incremental mode, you can use the ‘–incremental‘ option followed by the mode to use. This mode is what defines the charset to use and the password length limit.

John comes with some predefined incremental modes. To choose the mode that best suits your purposes, you can check the ‘john.conf‘ file where settings for John the Ripper are stored.

Here is an example of the Alpha mode taken from ‘john.conf‘:

[Incremental:Alpha]
File = $JOHN/alpha.chr
MinLen = 1
MaxLen = 13
CharCount = 52

The Alpha mode, as defined in this config, can crack passwords ranging from 1 to 13 characters in length, and with a charset of 52 possible characters.

Other predefined modes that you can find in the config file include : ASCII (All printable ASCII characters), Alnum (All alphanumeric characters), Lower (Only lowercase letters), and Digits (Only digits).

If you can’t find an incremental mode that fits your needs, you can add it in the config. If you decide to do so, I invite you to read the official documentation about how to customize John the Ripper.

The following command will try to crack the passwords using the digits incremental mode.

./john --incremental=Digits passwordFile

Hash Formats

By default, John the Ripper detects the hash type and then tries to crack the password based on that type. However, John can sometimes miss the correct type. In this case, it would be better to bypass the automatic hash detection and manually specify the type. To do so, you can use the ‘–format‘ option followed by the hash type.

For example, the following command will crack the MD5 hashes contained in passwordFile:

./john --format=Raw-MD5 passwordFile

To get the list of all supported hash formats, you can run the following command:

./john --list=formats

---

You now have all the basics that you need to start cracking passwords using John the Ripper. Of course, John has other features that we haven’t covered here, so if you want a more complete learning material, I invite you to check the official documentation.