Ravindra BagaleCourses & study guides मराठी Track your progress

22. Password Attacks

22.3 John the Ripper: Cracking Hashes

By Last updated:

John the Ripper ("John") cracks captured hashes offline. It auto-detects many hash types.

# Linux: combine passwd and shadow into one file John understands (root/lab only)
sudo unshadow /etc/passwd /etc/shadow > hashes.txt

# wordlist attack
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
# with mutation rules
john --wordlist=/usr/share/wordlists/rockyou.txt --rules hashes.txt
# show cracked results
john --show hashes.txt
# tell John the format if it guesses wrong
john --format=sha512crypt --wordlist=rockyou.txt hashes.txt

John also has helper tools such as zip2john file.zip > zip.hash and ssh2john id_rsa > key.hash to turn protected files and keys into crackable hashes (lab only).

Ravindra Bagale's Tip

John keeps running in the background, and students press Ctrl+C to stop it, then say "nothing happened". Use john --show to see earlier results, and while it is running, pressing any key shows the status – it does not stop. Be patient.

Lab

On Metasploitable 2 (or your own lab Linux VM), run sudo unshadow and crack the hashes with John using rockyou.txt and --rules. List which accounts cracked and how long each took. Then set a long random password on one account and confirm John cannot crack it quickly.

John as a defender's lab tool

Cracking hashes from your own password dump (exported from a lab app) shows you which users chose weak passwords. Then you force a reset and teach better policy.

  1. Export hashes only from a lab database you own.
  2. Run John offline on your Kali VM.
  3. List cracked passwords.
  4. Add policy: minimum length, breached-password check (Have I Been Pwned API), and 2FA.

Real examples

Indian company (sample): an HR portal forced resets for 180 accounts whose hashes cracked in under a minute. Global: NIST and NCSC password guidance favour length and screening against known-breached passwords over frequent forced rotation.

Common mistakes

  • Cracking hashes stolen from somewhere else. That is illegal.
  • Sharing cracked password lists.

Recap

  • Crack only your lab hashes.
  • Use the result to improve policy, not to attack people.

Defender's worksheet (do this today)

  1. Write the lesson title and date in your notebook.
  2. List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
  3. Run one safe command or checklist item from the lesson on a lab system only.
  4. Paste the command and its output under an Evidence heading.
  5. Write one fix you would give a teammate in two sentences.
  6. Write one mistake students make with this topic and how to avoid it.

More real-world pictures

Indian workplace (sample data)

Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.

Global practice

Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.

Home and family

Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.

Connect to earlier chapters

Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.

Common mistakes

  • Skipping written permission just for a quick scan.
  • Practising on hostel or office Wi-Fi targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Teach one other person the warning from this lesson.