John the Ripper/Password Generation - Revision history

Admin: /* Scripting with John the Ripper */

2015-08-19T20:35:26Z

Scripting with John the Ripper

← Older revision		Revision as of 20:35, 19 August 2015
Line 385:		Line 385:
	I use Python to iterate through combinations and parse pieces and commands together into scripts. I don't have complex or fancy Bash scripts with nice menus and quick prompts. Too bad. Maybe soon. (The problem, though, is that every good library has to be installed first. And I want a tool that deploys without hassle on a bare box. No "oops, forgot to install pandas, now I can't use any fo my scripts.")		I use Python to iterate through combinations and parse pieces and commands together into scripts. I don't have complex or fancy Bash scripts with nice menus and quick prompts. Too bad. Maybe soon. (The problem, though, is that every good library has to be installed first. And I want a tool that deploys without hassle on a bare box. No "oops, forgot to install pandas, now I can't use any fo my scripts.")

			[[John the Ripper/Scripting]]


	{{JohnFlag}}		{{JohnFlag}}

2015-08-19T20:33:49Z

Using Rules

@@ Line 82: / Line 82: @@
 Now we can call rules on this wordlist to create variations for password guesses.
 ==Using Rules==
 To use the rule, for exmaple the <code>KoreLogicRulesAppendYears</code> rule, we can call john with the <code>--rules=KoreLogicRulesAppendYears</code> argument, or with the <code>-rules:KoreLogicRulesAppendYears</code> argument (etiher works, but be consistent):
@@ Line 107: / Line 116: @@
 Nicole1900
 </pre>
 ==Defining Our Own Password Cracking Rules==

2015-08-19T20:32:37Z

← Older revision	Revision as of 20:32, 19 August 2015
(No difference)

2015-08-19T20:24:21Z

Installing Useful Rules

2015-08-19T20:23:39Z

Defining Our Own Password Cracking Rules

← Older revision		Revision as of 20:23, 19 August 2015
Line 107:		Line 107:
	Nicole1900		Nicole1900
	</pre>		</pre>

			==Installing Useful Rules==

			===KoreLogic Rules===

			Now, we want to be able to use some password cracking rules, so that our wordlists don't have to be terabytes to be effective. We can do that by telling John how to create password variations from the wordlist. This is where the rules come in.

			KoreLogic won the Defcon 2010 Crack Me If You Can Contest, using a set of rules that were released as part of the terms of victory. A guide to installing those rules is here: [[John_the_Ripper/Rules]]

	==Defining Our Own Password Cracking Rules==		==Defining Our Own Password Cracking Rules==

2015-08-19T20:21:21Z

Rules

← Older revision		Revision as of 20:21, 19 August 2015
Line 80:		Line 80:
	</pre>		</pre>

	Now we can call rules on this wordlist to create variations for password guesses. To use the rule, call john with the <code>--rules=KoreLogicRulesAppendYears</code> argument:		Now we can call rules on this wordlist to create variations for password guesses.

			==Using Rules==

			To use the rule, for exmaple the <code>KoreLogicRulesAppendYears</code> rule, we can call john with the <code>--rules=KoreLogicRulesAppendYears</code> argument, or with the <code>-rules:KoreLogicRulesAppendYears</code> argument (etiher works, but be consistent):

	<pre>		<pre>
	$ john -wordlist:/path/to/rockyou-10.txt -format:wpapsk -rules:KoreLogicRulesAppendYears ~~crackme~~		$ john -wordlist:/path/to/rockyou-10.txt -format:wpapsk -rules:KoreLogicRulesAppendYears john_password_file
	</pre>		</pre>

	If we call ~~this~~ with the stdout flag, we~~'ll~~ see what John is doing:		where we specify the wordlist, the encryption format of the john_password_file, the location of the john_password_file, and the rules to use. We'll cover how to get password files in a format John likes from programs like Airodump-ng and Aircrack below. But let's finish talking about the rules.

			If we call John with the stdout flag, instead of a password file, we can see what John is doing:

	<pre>		<pre>

2015-08-19T20:18:28Z

Rules

@@ Line 54: / Line 54: @@
 The rule is named KoreLogicRulesAppendYears.
-To use the rule, call john with the <code>--rules=KoreLogicRulesAppendYears</code> argument:
+Let's apply the rule to the rockyou password list. First, a quick look at that list:
 <pre>

2015-08-19T20:16:50Z

John and Stdout

← Older revision		Revision as of 20:16, 19 August 2015
Line 5:		Line 5:
	==John and Stdout==		==John and Stdout==

	Note that if you're using Kali 2.0, you'll need to install John jumbo 1.8 from source, instead of using the Kali 2.0 repository version of John, if you want to ~~send~~ John's password guesses to ~~stdout (~~or ~~pipe them~~ to ~~aircrack)~~.		Note that if you're using Kali 2.0, you'll need to install John jumbo 1.8 from source, instead of using the Kali 2.0 repository version of John, if you want to use John the Ripper to guess passwords but not actually crack them. This is useful for sending John's password guesses to a file to see how John works, or for piping John password guesses to another cracking program like [[Aircrack]].

	==Rules vs Modes==		==Rules vs Modes==

2015-08-19T20:08:07Z

Scripting with John the Ripper

← Older revision		Revision as of 20:08, 19 August 2015
Line 341:		Line 341:

	This also helps you assess the results of password cracking part of the way through, and improve your strategy based on your learnings.		This also helps you assess the results of password cracking part of the way through, and improve your strategy based on your learnings.

			I use Python to iterate through combinations and parse pieces and commands together into scripts. I don't have complex or fancy Bash scripts with nice menus and quick prompts. Too bad. Maybe soon. (The problem, though, is that every good library has to be installed first. And I want a tool that deploys without hassle on a bare box. No "oops, forgot to install pandas, now I can't use any fo my scripts.")



	{{JohnFlag}}		{{JohnFlag}}

2015-08-19T19:02:37Z

The Basics of Password Generation with John

← Older revision		Revision as of 19:02, 19 August 2015
Line 335:		Line 335:
	\|<pre>./john -wordlist:/root/codes/john/oneword.lst -rules:i2 -stdout > words</pre>		\|<pre>./john -wordlist:/root/codes/john/oneword.lst -rules:i2 -stdout > words</pre>
	\|}		\|}

			==Scripting with John the Ripper==

			It's pretty straightforward to script with John the Ripper. I find that the easiest way, since John the Ripper jobs can get pretty enormous, is to use a modular approach: keeping track of what password wordlists and what variations have been tried for a given password file manually, rather than trying to maintain consistency by using one enormous John command.

			This also helps you assess the results of password cracking part of the way through, and improve your strategy based on your learnings.



	{{JohnFlag}}		{{JohnFlag}}