What Is John The Ripper Tool And How To Use It?

John the Ripper is open source offline brute force tool – which means it tries to crack passwords on our machine using passwords database it has.  

We can use JtR in order to crack hashed and encrypted passwords – it can help us, as network managers, find weak passwords on our computer.  

JtR was first developed for unix systems but supports other systems today (windows, OSX).   

John the Ripper modes

John the ripper has four modes:  

1. 1. Wordlist mode – in this mode we need to specify a wordlist (a file contains passwords). JtR will compare the given hash and the hash of each password in the wordlist to find the correct password. We can create our own wordlist, use a wordlist from the internet or use John’s default wordlist – password.lst (location of the file in kali linux – usr/share/john/password.lst).  

2. 2. Single mode – in this mode JtR will create a new wordlist built from the login names, “GECOS” / “Full Name” fields, and users’ home directory names. It will use mangling method on each string so that from each password we’ll get a few more optional passwords. For example- if I have a user called kali -the single mode will try kali123, ilka,alik and so on…  

3. 3. Incremental mode – in this mode JtR will try all the possible combinations of characters (a,ab,ba,abc,1, 12…) therefore it takes a long time to crack a password. you should specify the password length and charset to short the cracking duration.  

4. 4. External mode – in this mode you can upload your own password cracking module.  

By default JtR will try single mode first , then wordlist mode and finally incremental mode  

John the ripper works in 2 main ways:  

1. 1. Dictionary attack – john uses default wordlists (file contains potential passwords) in its database to crack the password.    

2. 2. Brute force – John tries every possible combination of characters until the correct password is found   

JtR examples

• • Cracking password with JtR (John the ripper) “single crack” mode:  

I created a new user for the example named dasy:  

 I set the user password to dasy123:  

Make sure we see the user dasy in the /etc/shadow file – the file which contains all the hashed user passwords:  

Use JtR “single crack” mode to crack dasy password:  

 We can see the cracked passwords in the –show command:  

• • Cracking password with JtR (John the ripper) “wordlist” mode:  

I created a new user for the example named dasy2:  

I set the user password to abc:  

Make sure we see the user dasy2 in the /etc/shadow file – the file which contains all the hashed user passwords:  

Use JtR “wordlist” mode to crack dasy2 password:  

• • Cracking password with JtR (John the ripper) “incremental” mode:  

Use JtR “incremental” mode to crack dasy3, a new user I created, password:  

• • Install   

Simple use: john name_and_passwords_file.txt  

• • Brute force on hash file  

• • Brute force with password file