John the Ripper is a favourite password cracking tool of many pentesters. There is plenty of documentation about its command line options.
I’ve encountered the following problems using John the Ripper. These are not problems with the tool itself, but inherent problems with pentesting and password cracking in general.
Cracking Windows Password Hashes Using John the Ripper John the Ripper is a fast password cracker, currently available for many flavors of.NIX, DOS, Win32, BeOS, and OpenVMS. Its primary purpose is to detect weak passwords. In the rest of this lab, John the Ripper will be referred to as John. Exercise 1: using John the Ripper to crack the. Now you can use this tool to extract the hash from the Office document, and save it to a text file: #./office2john.py secret-company-secrets.docx hash.txt. Now check out the contents of the hash file if you want: # cat hash.txt. All you need at this point is a good password list to run through John the Ripper, and a few options to run it with.
- Sometimes I stumble across hashes on a pentest, but don’t recognise the format, don’t know if it’s supported by john, or whether there are multiple “–format” options I should try.
- The hashes you collect on a pentest sometimes need munging into a different format… but what’s the format john is expecting?
- John will occasionally recognise your hashes as the wrong type (e.g. “Raw MD5″ as “LM DES”). This is inevitable because some hashes look identical.
- Sometimes I gain access to a system, but can’t recall how to recover the password hashes for that particular application / OS.
These problems can all be sorted with a bit of googling or grepping through the john source code. I thought it might be helpful to compile a cheat sheet to reduce the amount of time I spend grepping and googling.
Sleek bill keygen crack. In the first release of this page I’ve:
John The Ripper 0 Password Hashes Cracked
- Copied example hashes out of the source code for most supported hash types.
- Provided examples of what your hashes.txt file might look like (though I’m sure other variations are supported that aren’t covered here yet).
- For each example hash I’ve stated whether it will be automatically recognised by john, or whether you’ll have to use the “–format” option (in which case I’ve included which –format option you need)
I haven’t yet done the following:
- Added reminders on how hashes can be collected.
- Added information on how to munge the hashes into a format supported by john.
This sheet was originally based on john-1.7.8-jumbo-5. Changes in supported hashes or hash formats since then may not be reflected on this page.
afs – Kerberos AFS DES
Supported Hash Formats
bfegg – Eggdrop
Supported Hash Formats
bf – OpenBSD Blowfish
Supported Hash Formats
bsdi – BSDI DES
Supported Hash Formats
crypt – generic crypt(3)
Supported Hash Formats
des – Traditional DES
Supported Hash Formats
dmd5 – DIGEST-MD5
Supported Hash Formats
TODO: No working example yet.
dominosec – More Secure Internet Password
Supported Hash Formats
<none> – EPiServer SID Hashes
Supported Hash Formats
hdaa – HTTP Digest access authentication
Supported Hash Formats
hmac-md5 – HMAC MD5
Supported Hash Formats
hmailserver – hmailserver
Supported Hash Formats
ipb2 – IPB2 MD5
Supported Hash Formats
krb4 – Kerberos v4 TGT
Supported Hash Formats
krb5 – Kerberos v5 TGT
Supported Hash Formats
lm – LM DES
Supported Hash Formats
lotus5 – Lotus5
Supported Hash Formats
md4-gen – Generic salted MD4
Supported Hash Formats
md5 – FreeBSD MD5
Supported Hash Formats
md5-gen – Generic MD5
Supported Hash Formats
TODO: No working example yet.
mediawiki – MediaWiki MD5s
Supported Hash Formats
mscash – M$ Cache Hash
Supported Hash Formats
mscash2 – M$ Cache Hash 2 (DCC2)
Supported Hash Formats
mschapv2 – MSCHAPv2 C/R MD4 DES
Supported Hash Formats
mskrb5 – MS Kerberos 5 AS-REQ Pre-Auth
Supported Hash Formats
mssql05 – MS-SQL05
Supported Hash Formats
mssql – MS-SQL
Supported Hash Formats
mysql-fast – MYSQL_fast
Supported Hash Formats
mysql – MYSQL
Supported Hash Formats
mysql-sha1 – MySQL 4.1 double-SHA-1
Supported Hash Formats
netlm – LM C/R DES
Supported Hash Formats
netlmv2 – LMv2 C/R MD4 HMAC-MD5
Supported Hash Formats
netntlm – NTLMv1 C/R MD4 DES [ESS MD5]
Supported Hash Formats
netntlmv2 – NTLMv2 C/R MD4 HMAC-MD5
Supported Hash Formats
nethalflm – HalfLM C/R DES
Supported Hash Formats
md5ns – Netscreen MD5
Supported Hash Formats
nsldap – Netscape LDAP SHA
Supported Hash Formats
ssha – Netscape LDAP SSHA
John The Ripper 0 Password Hashes Cracked 1 Left Handers
Supported Hash Formats
nt – NT MD4
Supported Hash Formats
openssha – OpenLDAP SSHA
Supported Hash Formats
oracle11 – Oracle 11g
Supported Hash Formats
oracle – Oracle
Supported Hash Formats
pdf – pdf
Supported Hash Formats
phpass-md5 – PHPass MD5
John The Ripper 0 Password Hashes Cracked 1 Left Handed
Supported Hash Formats
phps – PHPS MD5
Supported Hash Formats
pix-md5 – PIX MD5
Supported Hash Formats
po – Post.Office MD5
Supported Hash Formats
rar – rar
Supported Hash Formats
raw-md4 – Raw MD4
Supported Hash Formats
raw-md5 – Raw MD5
Supported Hash Formats
John The Ripper Pkzip2
raw-md5-unicode – Raw MD5 of Unicode plaintext
Supported Hash Formats
raw-sha1 – Raw SHA-1
Supported Hash Formats
raw-sha224 – Raw SHA-224
Supported Hash Formats
raw-sha256 – Raw SHA-256
Supported Hash Formats
raw-sha384 – Raw SHA-384
Supported Hash Formats
raw-sha512 – Raw SHA-512
Supported Hash Formats
salted-sha – Salted SHA
Supported Hash Formats
sapb – SAP BCODE
Supported Hash Formats
sapg – SAP CODVN G (PASSCODE)
Supported Hash Formats
sha1-gen – Generic salted SHA-1
Supported Hash Formats
skey – S/Key
Supported Hash Formats
TODO: No working example yet.
TODO: No working example yet.
TODO: No working example yet.
TODO: No working example yet.
ssh – ssh
Supported Hash Formats
sybasease – sybasease
Supported Hash Formats
xsha – Mac OS X 10.4+ salted SHA-1
Supported Hash Formats
zip – zip
Supported Hash Formats
Tags: johntheripper, pentest
Posted in Cheat Sheets