John the Ripper
John the Ripper (often shortened to JtR) is a widely used, powerful password cracking tool. It is designed to detect weak Unix passwords, but it also supports hundreds of hash and cipher types, including many commonly found in software and files (like zip files, rar files, and pdfs).
It is an essential tool in cracking challenges in CTFs, often used to:
- Crack password hashes found in various formats.
- Recover passwords for encrypted files (ZIP, RAR, PDF, etc.).
- Perform dictionary attacks or brute-force attacks against weak passwords.
Basic Usage Examples
Cracking a Password Hash
To crack a hash stored in a file named hashes.txt using a common wordlist (like the built-in rockyou.txt or one you provide):
john hashes.txt --wordlist=/path/to/your/wordlist.txt
John will attempt to crack the hashes and will display any cracked passwords. You can view previously cracked passwords with:
john --show hashes.txt
Cracking a Password-Protected Zip File
First, you need to extract the hash from the zip file using a specific John tool called zip2john. Then, feed the output to John:
zip2john challenge.zip > challenge.zip.hash john challenge.zip.hash --wordlist=/path/to/your/wordlist.txt
Replace challenge.zip with the name of your zip file. This process is similar for other file types like RAR (using rar2john) and PDF (using pdf2john).
Remember that the effectiveness of cracking depends heavily on the strength of the password and the quality of the wordlist used.
Wordlists
In Kali Linux installations, wordlists may be found using the following command (source)
wordlists