22.3 John the Ripper: Cracking Hashes
John the Ripper ("John") cracks captured hashes offline. It auto-detects many hash types.
# Linux: combine passwd and shadow into one file John understands (root/lab only)
sudo unshadow /etc/passwd /etc/shadow > hashes.txt
# wordlist attack
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
# with mutation rules
john --wordlist=/usr/share/wordlists/rockyou.txt --rules hashes.txt
# show cracked results
john --show hashes.txt
# tell John the format if it guesses wrong
john --format=sha512crypt --wordlist=rockyou.txt hashes.txt
John also has helper tools such as zip2john file.zip > zip.hash and ssh2john id_rsa > key.hash to turn protected files and keys into crackable hashes (lab only).
Ravindra Bagale's Tip
John background madhe chalu asto aani students Ctrl+C dabun band kartat, mag "kahi zale nahi" mhantat. john --show ne aadhiche results bagha, ani chalu astana kontahi key dabli tar status disto – band hot nahi. Patience theva.
Lab
On Metasploitable 2 (or your own lab Linux VM), run sudo unshadow and crack the hashes with John using rockyou.txt and --rules. List which accounts cracked and how long each took. Then set a long random password on one account and confirm John cannot crack it quickly.