John the Ripper: A password cracking tool

01 History of John the Ripper

John the Ripper (JtR) was originally designed by Solar Designer (Alexender Peslyak) in 1996 as a free open-source password cracker. It was designed to test password strength and retrieve cleartext passwords when given hashes. JtR was a program created for UNIX-based systems and has since over the years evolved into a cross-platform tool that is able to crack passwords irrespective of the Operating System, including Windows, macOS and Linux. Originally designed as a simple password bruise, it has within no time expanded to incorporate different hashing algorithms and attacks like dictionary based and brute force methods. Jack the Ripper was a murderer in 1888 in London, England. Just as people exposed to Jack the Ripper died, passwords exposed to John the Ripper are no longer secret.

What types of passwords is John the Ripper good at cracking?

John the Ripper is most effective when attacking weaker hashing algorithms (like MD5, DES, or SHA-1) and simple passwords.

What is a simple password

Passwords that contain common phrases

Short passwords

What are weak passwords

Simple Passwords

Passwords with common phrases are susceptible to dictionary attacks

Common are at risk of being in a rainbow table which makes it trivial for JtR

With social engineering all of this is made much simpler

If we know a part of the password, we can use the simple crack mode to easily crack the password

Password contains “Admin or “password” - if we know this, we can use the simple mode which makes it a lot easier

What does it fail at or what is it slow at doing?

It performs very poorly on much newer kinds of hashing algorithms like bcrypt and Argon2 which are designed to resist brute force attack.

Brute force attacks take the longest, so we want to target this with our passwords

use long passwords

Long Passphrases

Use mixed characters

02 Methods

Dictionary Attacks

John the Ripper can use precompiled lists of words (called dictionaries) as potential passwords. These lists may contain common passwords or variations of words that users might choose. In this case, JtR attempts to find the hash of each word on the list and compare it to the target password hash. Should such a word or number be located, John then proceeds to finding the matching password. This method is one of the quickest methods if the password pertains to a basic or average difficulty level. This is used in the word list mode.

Use the arrow keys to scroll right -->

Brute-force Attacks

When dictionary attacks fail, JtR can attempt a brute-force attack, JtR will then try crack passwords by subjecting all the possible plaintext, hashing them and comparing it to the input hash until it matches. John employs character frequency tables to try plaintext containing frequently used characters first. Although this approach covers every possibility, it tends to take time but does, however, identify passwords having no existence in a dictionary. This is used in the incremental mode.

Hybrid Attacks

John the Ripper is a password cracking application that supports the use of hybrid attacks, which includes dictionary attack and brute force attack. For instance, it may begin with a dictionary attack using the words but changing them by including some numbers or symbols like in a brute force method. This enables JtR to also utilize passwords that contain basic words with little variations, making it more efficient against moderately complicated passwords. This is used in the single crack mode.

Rainbow Table Attacks

With proper implementation, rainbow tables can help reduce the time taken to crack passwords by eliminating the need for generating hashes of the passwords. There are rainbow tables built into JtR and they assist in cracking several hash types, as they avoid the generation of each hash each time. This is used in the word list mode.

Rule-based Attacks

John the Ripper also empowers the user by allowing them to formulate rules of password generating processes to include features or patterns to the desired password. For instance, rules can be configured which include character sets that are more prominent. This is the use case for the external mode.

03 Modes of cracking

Single crack

This mode can be helpful in cases when a user has set a password for an account based on commonly available information or phrase in the username (e.g. admin: admin888).

Wordlist

As you can see, the dictionary attack method uses this mode.

Incremental

This mode is used by brute-force method.

External

It’s an optional mode. In this mode, John the Ripper may use program code to generate words.

Demo: Follow along to get password cracking!

To follow along and do the demo at the same time run this command in your home directory on the VMs. This will copy all the files needed for the demo into a folder in your directory called john_the_Ripper_Demo. To do so,

cp -r /home/hayden.mcnally/john_the_Ripper_Demo .

Attack mode 1: Single-crack mode

Single-crack mode generates passwords from the login information such as the full name or username and generates possible password choices which are then used to crack the password of the account.

In dictionary mode, a list of passwords in plain text format is provided to John the Ripper. John the Ripper will generate hashes for these plain text passwords and compare them with our hashed passwords, thereby attempting to crack the passwords. We will be using an already-created file for this mode. You can look at the file using the “cat crack_single.txt”

Run Single-crack Mode: To begin cracking the passwords using single mode, run the following command in the terminal:

john --single crack_single.txt

As the process runs, you should see John outputting the cracked passwords on your screen. Once the program is done you can use the following command to see the results:

john --show crack_single.txt

John the Ripper analyzes the usernames and generates potential passwords based on simple variations of the usernames. For example, if the username is "alice," it will attempt passwords like alice123, Alice2021, and similar predictable combinations. John will display the cracked passwords along with any that remain uncracked.

Attack mode 2: Wordlist mode

Part 1: Simple animal word passwords

In dictionary mode, a list of passwords in plain text format is provided to John the Ripper. John the ripper will generate hashes for these plain text passwords and compare them with our hashed passwords, thereby attempting to crack the passwords. To do so, a wordlist with names of various animals has been provided in the animals.txt file. This wordlist contains passwords including ‘dog’, ‘cat’, ‘worm’, ‘snake’, and ‘dolphin’. To add a new plaintext password, simply type the following command:

printf '%s' "animal name” | tr -d " -" >> animals.txt

I have created and provided another file, crack.txt, with md5 hashed passwords. The hashed passwords include ‘cat’, ‘dog’, ‘dolphin’, ‘shark’, ‘worm’, ‘snake’, and ‘moose’. To add a new hashed password of your choosing to your word list of passwords to be cracked, type the following command into your console:

openssl passwd -1 'password’ >> crack.txt

Note* - This command takes the plain text of your input password, ‘password’, and converts it into the hashed value depending on the format specified. To convert into md5 format, -1 will be used. Once all your passwords have been hashed and stored into the crack.txt file, type the following command into your console to run John the ripper:

john --wordlist:animals.txt --format=md5crypt crack.txt

This command compares the hashed passwords stored within our wordlist (crack.txt) to the plaintext wordlist file (animals.txt). Notice, passwords not present in the dictionary such as ‘moose’ and ‘shark’ were not cracked. This emphasizes the importance of having a strong and well-built word list for cracking passwords.

To check which passwords were cracked, type:

john --show crack.txt

Part 2: Using the wordlist ruleset

Now let's try using the ruleset provided by John the Ripper. To access the ruleset, type:

nano ../../etc/john.conf

We will be using a few of these rules to crack passwords using the –rules function.

I have created a crack_rules.txt file with hashed passwords. These passwords include ‘Cat1’, ‘dog1’, ‘sharkshark’, ‘snakesnake’, and ‘Mrow’, ‘moose5’. Notice, all these passwords use one of the provided rules within john. For example, sharkshark and snakesnake use the repeat rule. To run john the ripper to see how many of these passwords get cracked, type the following command:

john crack_rules.txt --wordlist=animals.txt --rules --format=md5crypt

This command uses the same animals.txt file and checks for different iterations of these passwords using the ruleset provided. Notice how moose5 was not cracked. Similar to part 1, this is because moose is not present in the wordlist. Additionally, sn@k3 is not cracked as the leak speech rule is not present in the ruleset. Again, to check how many passwords were cracked, type:

john crack_rules.txt --show

Attack mode 3: Incremental mode

Incremental mode is the most powerful mode where it generates passwords on the fly, generates hashes for each of these newly generated passwords, and then compares those hashes to the hashes of the passwords to be cracked. This sounds like a much stronger method, doesn’t it? But there is a slight problem. Since this mode attempts all character combinations, the cracking can go on for a long time if the password is too long or if it contains combinations of alphanumeric characters and symbols. As such, this mode is rarely used. In most cases, a combination of wordlist mode and social engineering attacks will do the job for you. Let's give this an attempt. To run incremental mode, type the following command:

john -i:digits crackInc.txt

Notice how this method takes a really long time to crack the password. This is due to the combinations of passwords based on the length. This is often why incremental mode, while the most powerful, is used as a last resort.

With this tutorial, you should now be able to crack passwords using John the Ripper!

For more info, visit these links!

https://charlesreid1.com/wiki/John_the_Ripper/Rules#List_All_the_Rules

https://www.openwall.com/john/doc/RULES.shtml

https://www.openwall.com/john/doc/EXAMPLES.shtml

https://www.freecodecamp.org/news/crack-passwords-using-john-the-ripper-pentesting-tutorial/