TD Cyber Labs

TrainersTool Trainers / John the Ripper Trainer 0 / 55 pts

john

John the Ripper

Red Team · Medium · 5 lessons

Once you loot a hash — from a database, /etc/shadow, or a leaked dump — John the Ripper tries to recover the plaintext. The workflow is always the same: identify the hash type, then run a wordlist against it. Your home directory holds hashes.txt (two MD5 hashes) and the wordlist rockyou-mini.txt.

1
Identify the hash type
Cracking the wrong format wastes hours. hashid inspects a hash's shape and suggests what it is — a 32-character hex string is most likely MD5 (or NTLM). Always identify first.
hashid 5f4dcc3b5aa765d61d8327deb882cf99
2
Run John against the file
Give John a file of hashes and, with no mode specified, it tries its built-in strategies in order. For simple hashes this alone often recovers a password. Try it, then look at what came back.
john hashes.txt
3
Dictionary attack with --wordlist
The workhorse mode: --wordlist points John at a password list and it hashes each entry looking for a match. rockyou.txt (here, rockyou-mini.txt) is the classic starting list.
john --wordlist=rockyou-mini.txt hashes.txt
4
Force a format with --format
When autodetection guesses wrong, --format pins the algorithm — e.g. --format=raw-md5 for a bare MD5. This is essential when a hash could be several types.
john --format=raw-md5 hashes.txt
5
Review results with --show
John saves cracks to a pot file. --show reprints every recovered password without re-running the attack — how you read your results after the fact.
john --show hashes.txt

Applications

practice 10.10.10.10--:--

learner@kali: ~ — Terminal