• Abstract and Figures
• Public Full-text

TUTORIAL PASSWORD CRACKING JOHN THE RIPPER: TUTORIAL CRACK PASSWORDS How secure are your passwords? Find out (and learn to stay safer BEN EVERARD online) by trying to crack them. ost people use passwords many times a WHY DO THIS? day. They’re the keys that unlock digital • Check the strength of Mdoors and give us access to our computers, password hashes. our email, our data and sometimes even our money. • Understand the options As more and more things move online, passwords when creating a secure secure an ever growing part of our lives. We’re told to system. add capital letters, numbers and punctuation to these • Learn how password crackers work so you passwords to make them more secure, but just what can create secure difference do these have? What does a really secure passwords. password look like? In order to answer these questions, we’re going to turn attacker and look at the methods used to crack passwords. There are a few password-cracking tools available for Linux, but we’re going to use John The There are online services (like www.cloudcracker.com) Ripper, because it’s open source and is in most distros’ that will try to crack passwords for a small fee. repositories (usually, the package is just called john). In order to use it, we need something to try to crack. After downloading that file, you can try and crack We’ve created a file with a set of MD5-hashed the passwords with: passwords. They’re all real passwords that were john md5s-short stolen from a website and posted on the internet. The passwords in this file are all quite simple, and you MD5 is quite an old hashing method, and we’re using should crack them all very quickly. Not all password The speed at which John it because it should be relatively quick to crack on hashes will surrender their secrets this easily. can crack hashes varies most hardware. To make matters easier, all the When you run john like this, it tries increasingly dramatically depending hashes use the same salt (see boxout for details). more complex sequences until it finds the password. on the hashing algorithm. Slow algorithms (such Although we’ve chosen a setup that’s quick to crack, If there are complex passwords, it may continue as bcrypt) can be tens of this same setup is quite common in organisations running for months or years unless you press Ctrl+C thousands of times slower that don’t focus on security. You can download the to terminate it. than quick ones like DES. files from www.linuxvoice.com/passwords. Once this has finished running you can see what passwords it found with: john --show md5s-short That’s the simplest way of cracking passwords – and you’ve just seen that it can be quite effective – now lets take a closer look at what just happened. John The Ripper works by taking words from a dictionary, hashing them, and comparing these hashes with the ones you’re trying to crack. If the two hashes match, that’s the password you’re looking for. A crucial point in password cracking is how quickly you can perform these checks. You can see how fast john can run on your computer by entering: john --test This will benchmark a few different hashing algorithms and give their speeds in checks per second (c/s). By default, John will run in single-threaded mode, but if you want to take full advantage of a multi- threaded approach, you can add the --fork=N option to the command where N is the number of processes. Typically, this is best where N is the number of CPU cores you want to dedicate to the task. 86 www.linuxvoice.com PASSWORD CRACKING TUTORIAL Processing power The faster your computer can hash passwords, the more you can try in a given amount of time, and therefore the better chance you have of cracking the password. In this article, we’ve used John The Ripper because it’s an open source tool that’s available on almost all Linux platforms. However, it’s not always the best option. John runs on the CPU, but password hashing can be run really efficiently on graphics cards. Hashcat is password cracking program that runs on graphics cards, and on the right hardware can perform much better than John. Specialised password cracking computers usually have several high-performance GPUs and rely on these for their speed. You probably won’t find Hashcat in your distro’s repositories, but you can download it from www.hashcat. net (it’s free as in zero cost, but not free as in free software). It comes in two flavours: ocl-Hashcat for OpenCL cards (AMD), and cuda-Hashcat for Nvidia cards. Raw performance, of course, means very little without finesse, so fancy hardware with GPU crackers means very little if you don’t have a good set of words and rules. In the previous example, you probably found John cracked most of the passwords very quickly. This is Hydra can be used to try because they were all common passwords. Since it won’t bother trying to crack anything, as it already and guess passwords on John works by checking a dictionary of words, has all the passwords. The regular dictionary isn’t as network services, although common passwords are very easy to find. good as John The Ripper’s dictionary, so this won’t get this is much slower than John comes with a word list that it uses by default. all the passwords. cracking hashes locally. This is quite good, but to crack more and more secure passwords, you then need a word list with more Mangling words words. People who crack passwords regularly often Secure services often place rules on what passwords build their own word lists over years, and they can are allowed. For example, they might insist on upper come from many sources. General dictionaries are and lower case letters as well as numbers or good places to start (which languages you pick will punctuation. In general, people won’t add these depend on your target demographic), but these don’t randomly, but put them in words in specific ways. For usually contain names, slang or other terms. example, they might add a number to the end of a Crackers regularly steal passwords from word, or replace letters in a word with punctuation organisations (often websites) and post them online. that looks similar (such as a with @). These password leaks may contain thousands or even John The Ripper provides the tools to mangle words millions of passwords, so these are a great source of in this way, so that we can check these combinations extra words. To search out even more elusive words, from a normal word list. crackers turn to web scrapers and other tools to find For this example, we’ll use the password file from sequences of characters that are used. There are www.linuxvoice.com/passwords, which contains the some good sources of words at https://wiki. passwords: password, Password, PASSWORD, skullsecurity.org/Passwords, while good word lists password1, p@ssword, P@ssword, Pa55w0rd, are often sold (such as https://crackstation.net/ p@55w0rd. First, create a new text file called buy-crackstation-wordlist-password-cracking- passwordlist containing just: dictionary.htm, which is pay-what-you-want). The password latter has about 1.5 billion words. Larger word lists are This will be the dictionary, and we’ll create rules that available, but often for a fee. crack all the passwords based of this one root word. With John, you can use a custom word list with the Rules are specified in the john.conf file. By default, --wordlist=<filename> option. For example, to check john uses the configuration files in ~/.john, so you’ll passwords using your system’s dictionary, use: need to create that file in a text editor. We’ll start by rm ~/.john/john.pot adding the lines: john --wordlist=/usr/share/dict/words md5s-short [List.Rules:Wordlist] This should work on most Debian-based systems, : but on other distros, the words file may be in a c different place. The first line deletes the file that The first line tells john what mode you want to use contains the cracked passwords. If you don’t run this, the rules for, end every line below that is a rule (we’ll www.linuxvoice.com 87 TUTORIAL PASSWORD CRACKING On the second line, the $ symbol means append the following character to the password. In this case, it’s not a single character, but a class of characters (digits), so it tries ten different words (password0, password1… password9). To get the remaining passwords, you need to add the following rules to the config file: csa@ sa@so0ss5 css5so0 The rule s<character1><character2> replaces all occurrences of character1 with character2. In the above rules, this is used to switch a for @ (sa@), o for 0 (so0) and s for 5 (ss5). All of these are combination rules that build up the final word through more than one alteration. Limitations of cracking rules The language for creating rules isn’t very expressive. For example, you can’t say: ‘try every combination of A text-menu driven tool for creating John The Ripper config files is available from the following rules’. The reason for that is speed. The https://sites.google.com/site/reusablesec2/jtrconfiggenerator. rules engine has to be able to run thousands or even millions of times per second while not significantly add more in a minute).

Load more

  4

Copy Link