John The Ripper

Find format

john --list=formats | grep -iF "md5".

Examples

john --format=whirlpool --wordlist=/usr/share/wordlists/rockyou.txt hash4.txt
john --format=raw-sha256 --wordlist=/usr/share/wordlists/rockyou.txt hash3.txt
john --format=raw-sha1 --wordlist=/usr/share/wordlists/rockyou.txt hash2.txt
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hash1.txt

Hashes from /etc/shadow - SHA-512

┌─[xor@parrot]─[~/Téléchargements]
└──╼ $ls
passwd  rockyou.txt  rockyou.txt.bz2  shadow
┌─[xor@parrot]─[~/Téléchargements]
└──╼ $unshadow passwd shadow > mypasswd
┌─[xor@parrot]─[~/Téléchargements]
└──╼ $john --wordlist=rockyou.txt mypasswd
Warning: detected hash type "sha512crypt", but the string is also recognized as "HMAC-SHA256"
Use the "--format=HMAC-SHA256" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 128/128 SSE2 2x])
Cost 1 (iteration count) is 5000 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
password1        (root)
1g 0:00:00:01 DONE (2019-08-21 15:20) 0.9615g/s 123.0p/s 123.0c/s 123.0C/s 123456..diamond
Use the "--show" option to display all of the cracked passwords reliably
Session completed

SSH Private Key - RSA

root@Host-001:~/Bureau# vim id_rsa 
root@Host-001:~/Bureau# python /usr/share/john/ssh2john.py id_rsa > id_rsa_hash.txt
root@Host-001:~/Bureau# john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa_hash.txt

Windows NTLM

hashdump format = User Name: RID: LM-HASH Value: NT-HASH value

john hash /usr/share/wordlists/rockyou.txt --format=NT

Zip files

1. zip2john zipfile.zip > zip_hash.txt
2. john --wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt

Other tool: fcrackzip

fcrackzip -v -u -D -p /usr/share/wordlists/rockyou.txt sample.zip

RAR Archives

1. rar2john rarfile.rar > rar_hash.txt
2. john --wordlist=/usr/share/wordlists/rockyou.txt rar_hash.txt

Single crack mode

Buid it's own dictionary based on the information that it has been fed

john --single --format=[format] [path to file]

Sources

Last updated