John

De Linuxmemo.

Version du 26 décembre 2016 à 17:55

John the Ripper password cracker

http://www.openwall.com/john/

John est capable de casser différents formats de chiffrement de mots de passe, notamment les mots de passe:

crypt(Unix), MD5, Blowfish, Kerberos, AFS, et les LM hashes de Windows NT/2000/XP/2003.

Des modules additionnels sont disponibles pour lui permettre de casser les mots de passe basés sur les hash MD4 et les mots de passe enregistrés dans MySQL ou LDAP, ainsi que les mots de passe NTLM, pour les de rnières versions de Windows.

Usage: john [OPTIONS] [PASSWORD-FILES]

All  the  options recognized by john start with a single dash (`-').

Les modes

If no mode is specified, john will try "single" first, then "wordlist" and finally "incremental".

• Wordlist

John will simply use a file with a list of words that will be
checked against the passwords. See RULES for  the  format  of
wordlist files.

• Single crack

In  this  mode, john will try to crack the password using the
login/GECOS information as passwords.

• Incremental

This is the most powerful mode. John will try  any  character
combination  to  resolve  the  password.  Details about these
modes can be found in the MODES file in john's documentation,
including how to define your own cracking methods.

--single                   "single crack" mode
--wordlist=FILE --stdin    wordlist mode, read words from FILE or stdin
--rules                    enable word mangling rules for wordlist mode
--incremental[=MODE]       "incremental" mode [using section MODE]
--external=MODE            external mode or word filter

--stdout[=LENGTH]          just output candidate passwords [cut at LENGTH]
--restore[=NAME]           restore an interrupted session [called NAME]
--session=NAME             give a new session the NAME
--status[=NAME]            print status of a session [called NAME]
--make-charset=FILE        make a charset, FILE will be overwritten
--show                     show cracked passwords
--test[=TIME]              run tests and benchmarks for TIME seconds each
--users=[-]LOGIN|UID[,..]  [do not] load this (these) user(s) only
--groups=[-]GID[,..]       load users [not] of this (these) group(s) only
--shells=[-]SHELL[,..]     load users with[out] this (these) shell(s) only
--salts=[-]COUNT           load salts with[out] at least COUNT passwords only
--format=NAME              force hash type NAME: DES/BSDI/MD5/BF/AFS/LM/crypt
--save-memory=LEVEL        enable memory saving, at LEVEL 1..3

--format=NAME              Override the ciphertext format detection. Currently, valid format names are DES, BSDI, MD5, BF,  AFS,  LM.

Résultats

Once John finds a password, it will be printed to the terminal and saved into a file called ~/.john/john.pot.

cat ~/.john/john.pot

John will read this file when it restarts so it doesn't try to crack already done passwords. To see the cracked passwords, use

john -show passwd.txt

Session

Press 'q' or Ctrl-C to abort saving point information to a file ( ~/.john/john.rec by default) To continue an interrupted session, run:

john -restore