In general, the time required to crack passwords is directly linked to the strength of the password but, above all, its length. Still, if the password is short and/or weak, John the Ripper can crack such data quickly. In the worst-case scenario, the credentials are in plain text, but most of the time you only get a hash. It often comes after stealing critical data, such as databases that contain credentials.

The most popular techniques associated with password cracking are brute-force and dictionary attacks. How Does Password Cracking Work?īefore we dive into a practical example, you have to understand the basics of password cracking. For our example, we won’t need a powerful machine. But that would be for more advanced uses, so any recent computer will do the job correctly. In terms of hardware, tutorials sometimes recommend large RAM (16GB) and a good graphics processing unit (GPU).

You’ll also need samples to attack, which are easy to find on platforms such as GitHub, but you can also generate your own hashes. However, you may have to install additional modules manually to crack specific file types, such as zip archives. There are other installation modes available, for example, on Debian-based machines: The easiest way is to use a virtual machine with a dedicated operating system like Kali Linux. You’ll need a proper lab to test the command lines. Of course, it’s only one tool in the pen-tester’s arsenal, but it’s particularly convenient to use, and it automates lots of manual operations you would have to run otherwise.Īlso read: Top Open Source Penetration Testing Tools How to Setup Your Test Environment John the Ripper can demonstrate how easy it is to reveal weak passwords (and the seemingly more sophisticated ones) using a leaked database and a free tool. Pen-testing distributions such as Kali Linux and Parrot OS usually include the full package, so you won’t need additional installations. You can then use these hashes as input to find the password with John the Ripper. kbdx files with keepass2john, and password-protected zip archives with zip2john. This open-source package is free to download and has several modules for generating hashes from a range of file types, such as Secure Shell (SSH) keys with ssh2john. It’s often what pen-testers and ethical hackers use to find the true passwords behind hashes. John the Ripper is a popular password cracking tool that can be used to perform brute-force attacks using different encryption technologies and helpful wordlists.

Download john the ripper installer