Crack the password in Linux using John the ripper:
John the Ripper is a fast password cracker, Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix systems, supported out of the box are Windows LM hashes, plus lots of other hashes and ciphers in the community-enhanced version
John the ripper is a popular dictionary based password cracking tool. It uses a wordlist full of passwords and then tries to crack a given password hash using each of the password from the wordlist. In other words its called brute force password cracking and is the most basic form of password cracking. It is also the most time and cpu consuming technique. More the passwords to try, more the time required.
But still if you want to crack a password locally on your system then john is one of the good tools to try. John is in the top 10 security tools in Kali linux.
In this topic i am going to show you, how to use the unshadow command along with john to crack the password of users on a linux system. On linux the username/password details are stored in the following 2 files
#/etc/passwd
#/etc/shadow
The actual password hash is stored in /etc/shadow and this file is accessible on with root access to the machine. So try to get this file from your own linux system. Or first create a new user with a simple password. I will create a new user on my linux system named happy, with password chess.
Now that our new user is already created its time to crack his password.
#unshadow
The unshadow command will basically combine the data of /etc/passwd and /etc/shadow to create 1 file with username and password details. Usage is quite simple.
#unshadow /etc/passwd /etc/shadow > ~/crack
We redirected the output of unshadow command to a new file called crack.
Now this new file shall be cracked by john. For the wordlist we shall be using the password list that comes with john on kali linux. It is located at the following path /usr/share/john/password.lst or you can use your own password lists too.
#john –wordlist=/usr/share/john/password.lst ~/crack
Use the “–show” option to display all of the cracked passwords reliably
So in the above command john was able to crack the hash and get us the password “chess” for the user “happy”. Now john was able to crack, only because the password “chess” was present in the password list. If it were not there then john would have failed.
Use the show option to list all the cracked passwords.
#john –show ~/crack
John the ripper is a popular dictionary based password cracking tool. It uses a wordlist full of passwords and then tries to crack a given password hash using each of the password from the wordlist. In other words its called brute force password cracking and is the most basic form of password cracking. It is also the most time and cpu consuming technique. More the passwords to try, more the time required.
But still if you want to crack a password locally on your system then john is one of the good tools to try. John is in the top 10 security tools in Kali linux.
In this topic i am going to show you, how to use the unshadow command along with john to crack the password of users on a linux system. On linux the username/password details are stored in the following 2 files
#/etc/passwd
#/etc/shadow
The actual password hash is stored in /etc/shadow and this file is accessible on with root access to the machine. So try to get this file from your own linux system. Or first create a new user with a simple password. I will create a new user on my linux system named happy, with password chess.
Now that our new user is already created its time to crack his password.
#unshadow
The unshadow command will basically combine the data of /etc/passwd and /etc/shadow to create 1 file with username and password details. Usage is quite simple.
#unshadow /etc/passwd /etc/shadow > ~/crack
We redirected the output of unshadow command to a new file called crack.
Now this new file shall be cracked by john. For the wordlist we shall be using the password list that comes with john on kali linux. It is located at the following path /usr/share/john/password.lst or you can use your own password lists too.
#john –wordlist=/usr/share/john/password.lst ~/crack
Use the “–show” option to display all of the cracked passwords reliably
So in the above command john was able to crack the hash and get us the password “chess” for the user “happy”. Now john was able to crack, only because the password “chess” was present in the password list. If it were not there then john would have failed.
Use the show option to list all the cracked passwords.
#john –show ~/crack
