Knowledge Base Wiki

Search for LIMS content across all our Wiki Knowledge Bases.

Type a search term to find related articles by LIMS subject matter experts gathered from the most trusted and dynamic collaboration tools in the laboratory informatics industry.

Not to be confused with Jack the Ripper.
John the Ripper
Developer(s)OpenWall
Initial release1996[1]
Stable release
1.9.0[2] / May 14, 2019 (2019-05-14)
Repository
Operating systemCross-platform
TypePassword cracking
LicenseGNU General Public License
Proprietary (Pro version)
Websitewww.openwall.com/john/ Edit this at Wikidata

John the Ripper is a free password cracking software tool.[3] Originally developed for the Unix operating system, it can run on fifteen different platforms (eleven of which are architecture-specific versions of Unix, DOS, Win32, BeOS, and OpenVMS). It is among the most frequently used password testing and breaking programs[4] as it combines a number of password crackers into one package, automatically detects password hash types, and includes a customizable cracker. It can be run against various encrypted password formats including several crypt password hash types most commonly found on various Unix versions (based on DES, MD5, or Blowfish), Kerberos AFS, and Windows NT/2000/XP/2003 LM hash. Additional modules have extended its ability to include MD4-based password hashes and passwords stored in LDAP, MySQL, and others.[5]

Sample output

Here is a sample output in a Debian environment. 

$ cat pass.txt
user:AZl.zWwxIh15Q
$ john -w:password.lst pass.txt
Loaded 1 password hash (Traditional DES [24/32 4K])
example         (user)
guesses: 1  time: 0:00:00:00 100%  c/s: 752  trying: 12345 - pookie

The first line is a command to expand the data stored in the file "pass.txt". The next line is the contents of the file, i.e. the user (AZl) and the hash associated with that user (zWwxIh15Q). The third line is the command for running John the Ripper utilizing the "-w" flag. "password.lst" is the name of a text file full of words the program will use against the hash, pass.txt makes another appearance as the file we want John to work on.

Then we see output from John working. Loaded 1 password hash — the one we saw with the "cat" command — and the type of hash John thinks it is (Traditional DES). We also see that the attempt required one guess at a time of 0 with a 100% guess rate.

Attack types

One of the modes John can use is the dictionary attack.[6] It takes text string samples (usually from a file, called a wordlist, containing words found in a dictionary or real passwords cracked before), encrypting it in the same format as the password being examined (including both the encryption algorithm and key), and comparing the output to the encrypted string. It can also perform a variety of alterations to the dictionary words and try these. Many of these alterations are also used in John's single attack mode, which modifies an associated plaintext (such as a username with an encrypted password) and checks the variations against the hashes.

John also offers a brute force mode, dubbed "incremental mode".[6] In this type of attack, the program goes through all the possible plaintexts, hashing each one and then comparing it to the input hash. John uses character frequency tables to try plaintexts containing more frequently used characters first. This method is useful for cracking passwords that do not appear in dictionary wordlists, but it takes a long time to run.

In addition to wordlist mode and incremental mode, there is :

  • Markov mode — uses research by Arvind Narayanan and Vitaly Shmatikov[7][8][9] to create candidates
  • Mask mode — uses a user-supplied pattern to create candidates
  • "Single crack" mode — uses details like the user's login name, full name, home directory name, et al. as candidates
  • Subsets mode — generates candidates based on complexity, prioritising longer simple passwords over shorter complex ones
  • Regex mode — an experimental mode that uses a user-supplied regular expression, similar to the aforementioned mask mode, to create candidates
  • Mode stacking — utilises the mask or regex modes in combination with another mode

See also

References

  1. ^ "john-users – Re: When was John created?". Archived from the original on 2021-10-28. Retrieved 2021-10-28.
  2. ^ "Announce - [openwall-announce] John the Ripper 1.9.0-jumbo-1". Archived from the original on 2020-11-08. Retrieved 2019-06-04.
  3. ^ Anonymous (2001). Maximum Linux Security (2 ed.). Sams Publishing. p. 154. ISBN 0-672-32134-3.
  4. ^ "Password Crackers". Concise Cybersecurity. Archived from the original on 2017-04-04. Retrieved 2016-12-03.
  5. ^ "John the Ripper". sectools.org. Archived from the original on 2019-03-15. Retrieved 2016-03-06.
  6. ^ a b "john/doc/MODES at bleeding-jumbo · openwall/john". GitHub. Retrieved 2024-10-30.
  7. ^ "john/doc/MARKOV at bleeding-jumbo · openwall/john". GitHub. Retrieved 2024-10-30.
  8. ^ Narayanan, A., Shmatikov, V. (2005), Fast Dictionary Attacks on Passwords Using Time-Space Tradeoff, retrieved 30 October 2024
  9. ^ Narayanan, Arvind; Shmatikov, Vitaly (2005-11-07). "Fast dictionary attacks on passwords using time-space tradeoff". ACM: 364–372. doi:10.1145/1102120.1102168. ISBN 978-1-59593-226-6. {{cite journal}}: Cite journal requires |journal= (help)
source: https://en.wikipedia.org/wiki/John_the_Ripper