John the Ripper/Scripting - Revision history

Admin: /* The Script */

2016-03-28T16:52:20Z

The Script

← Older revision		Revision as of 16:52, 28 March 2016
Line 31:		Line 31:
	Here's what the Python script will look like:		Here's what the Python script will look like:

	<~~source lang="python"~~>		<pre>
	import os		import os

Line 91:		Line 91:
	sf.write(the_big_one+"\n\n")		sf.write(the_big_one+"\n\n")

	</~~source~~>		</pre>

	==The Result==		==The Result==

Admin: /* A Word on Simplicity */

2016-03-28T16:26:36Z

A Word on Simplicity

← Older revision		Revision as of 16:26, 28 March 2016
Line 3:		Line 3:
	=A Word on Simplicity=		=A Word on Simplicity=

	First, I was using Python. Not only was I using Python, I was using simple, operating system level Python. Why? Because in a real world situation, ~~your Numpy will break~~, your ~~Pandas will break~~, you ~~will not need to plot anything~~, your fancy analysis scripts will stay tucked away at home. Practical scripts require simplicity to be robust.		First, I was using Python. Not only was I using Python, I was using simple, operating system level Python. Why? Because in a real world situation, you won't have network access, or your numpy won't compile, or you'll be missing an x terminal, and your fancy analysis scripts will stay tucked away at home. Practical scripts require simplicity to be robust.

	Can you run your tools immediately after you reinstall your operating system? Do you have packages that are absolutely essential archived somewhere? Somewhere close at hand?		Can you run your tools immediately after you reinstall your operating system? Do you have packages that are absolutely essential archived somewhere? Somewhere close at hand?

Admin: /* The Script */

2015-08-20T01:30:24Z

The Script

← Older revision		Revision as of 01:30, 20 August 2015
Line 93:		Line 93:
	</source>		</source>

	which ~~will result in the following script~~:		==The Result==

			The resulting script, which is not particularly interesting since I only have one router handshake, looks like this:

	<pre>		<pre>

Admin: /* The Procedure */

2015-08-20T01:29:49Z

The Procedure

← Older revision		Revision as of 01:29, 20 August 2015
Line 7:		Line 7:
	Can you run your tools immediately after you reinstall your operating system? Do you have packages that are absolutely essential archived somewhere? Somewhere close at hand?		Can you run your tools immediately after you reinstall your operating system? Do you have packages that are absolutely essential archived somewhere? Somewhere close at hand?

	=The Procedure=		=The Script=

			==Script Procedure==

	Depending on what kind of passwords you're trying to crack with John the Ripper, your procedure will look different. For example, on a wireless network you'll need to obtain handshake files and convert them to the right format for each username and password combination, but with Unix password files, you have one big list in a single file.		Depending on what kind of passwords you're trying to crack with John the Ripper, your procedure will look different. For example, on a wireless network you'll need to obtain handshake files and convert them to the right format for each username and password combination, but with Unix password files, you have one big list in a single file.

	~~==WPA Procedure==~~

	The complications of scripting WPA cracking with John the Ripper lies mainly in extracting the necessary information that leads up to the cracking. Listening to networks, finding clients, attacking access points, capturing handshakes, and converting them are all done prior to using John.		The complications of scripting WPA cracking with John the Ripper lies mainly in extracting the necessary information that leads up to the cracking. Listening to networks, finding clients, attacking access points, capturing handshakes, and converting them are all done prior to using John.
Line 19:		Line 19:
	Once we have the John password file, there isn't anything particularly unusual about the password file, except that WPA requires a minimum password length of 8.		Once we have the John password file, there isn't anything particularly unusual about the password file, except that WPA requires a minimum password length of 8.

	==~~What~~ Script ~~Will Do~~==		==Script Steps==

	What we want in the end is a chunk of script that will run John with various options, wordlists, rules, etc. We can use Python to iterate through the different combinations and create a bash script that we can use to run John.		What we want in the end is a chunk of script that will run John with various options, wordlists, rules, etc. We can use Python to iterate through the different combinations and create a bash script that we can use to run John.

Admin: /* The Script */

2015-08-20T01:29:00Z

The Script

← Older revision		Revision as of 01:29, 20 August 2015
Line 100:		Line 100:
	# Wordlist: /root/codes/seclists/Passwords/rockyou-50.txt		# Wordlist: /root/codes/seclists/Passwords/rockyou-50.txt
	# Rule: CMR1		# Rule: CMR1
	/~~root~~/~~codes/_sources/john-1.7.9-jumbo-7/run~~/john -wordlist:/~~root/codes~~/~~seclists/Passwords~~/rockyou-50.txt -rules:CMR1 /~~root~~/~~dumps/2015-08-15~~/~~myrouter~~.johnpw		/path/to/john -wordlist:/path/to/rockyou-50.txt -rules:CMR1 /path/to/myrouterhandshake.johnpw
	</pre>		</pre>

Admin: /* The Procedure */

2015-08-20T01:28:16Z

The Procedure

← Older revision		Revision as of 01:28, 20 August 2015
Line 18:		Line 18:

	Once we have the John password file, there isn't anything particularly unusual about the password file, except that WPA requires a minimum password length of 8.		Once we have the John password file, there isn't anything particularly unusual about the password file, except that WPA requires a minimum password length of 8.

			==What Script Will Do==

			What we want in the end is a chunk of script that will run John with various options, wordlists, rules, etc. We can use Python to iterate through the different combinations and create a bash script that we can use to run John.

			This requires looping over each rule, over each password file, and over each wordlist, and using John to try each of those combinations. Our result will be a long script with lots of John commands that we can run in a screen, using the fire-n-forget method.

			The input will be a list of John password files, which will contain the BSSID and ESSID information and the handshakes.

			==The Script==

			Here's what the Python script will look like:

			<source lang="python">
			import os

			with open('johnpw_filelist','rb') as f:
			z = f.readlines()
			john_pw_files = list(z)


			# for each john file,
			# we want to go through a regiment of stuff to try


			# strategy:
			# large word list
			# small numbers of variations at a time

			wordlists = ['/root/codes/seclists/Passwords/rockyou-50.txt', #100k
			'/root/codes/seclists/Passwords/english.txt', #300k
			'/root/codes/seclists/Passwords/darkc0de.txt',#1M
			'/root/codes/seclists/Passwords/rockyou.txt', #14M
			'/root/codes/wordlists/seattle.txt']

			rules=['CMR1',
			'CMRYears',
			'CMR2015',
			'CMRNum',
			'CMRSpec',
			'CMRNumNum',
			'CMRNumSpec',
			'CMRNumNumNum']

			scriptfile = 'crack.sh'

			with open(scriptfile,'w') as sf:

			sf.write('#!/bin/bash')
			sf.write('\n')

			for rule in rules:

			RULES=rule

			for wd in wordlists:

			WORDLIST=wd

			JOHN_BIN='/root/codes/_sources/john-1.7.9-jumbo-7/run/john'

			temp = map(str.strip, john_pw_files)
			john_pw_files = temp

			cmd = [JOHN_BIN, '-wordlist:'+WORDLIST, '-rules:'+RULES] + john_pw_files

			the_big_one = ' '.join(cmd)

			sf.write("\n")
			sf.write("# Wordlist: "+wd+"\n")
			sf.write("# Rule: "+rule+"\n")
			sf.write(the_big_one+"\n\n")

			</source>

			which will result in the following script:

			<pre>
			#!/bin/bash

			# Wordlist: /root/codes/seclists/Passwords/rockyou-50.txt
			# Rule: CMR1
			/root/codes/_sources/john-1.7.9-jumbo-7/run/john -wordlist:/root/codes/seclists/Passwords/rockyou-50.txt -rules:CMR1 /root/dumps/2015-08-15/myrouter.johnpw
			</pre>

Admin at 20:47, 19 August 2015

2015-08-19T20:47:20Z

← Older revision		Revision as of 20:47, 19 August 2015
Line 18:		Line 18:

	Once we have the John password file, there isn't anything particularly unusual about the password file, except that WPA requires a minimum password length of 8.		Once we have the John password file, there isn't anything particularly unusual about the password file, except that WPA requires a minimum password length of 8.




			{{JohnFlag}}

Admin at 20:43, 19 August 2015

2015-08-19T20:43:32Z

@@ Line 1: / Line 1: @@
 How to go from a list of John the Ripper password files to a cracked password or two?
-=Python=
+=A Word on Simplicity=
-First, I was using Python. Not only was I using Python, I was using simple, operating system level Python. Why? Because in a real world situation, your Numpy will break, your Pandas will break, you will not need to plot anything, your fancy analysis scripts will stay tucked away at home. Practical scripts require simplicity to be robust. Can you run your tools immediately after you reinstall your operating system?
+First, I was using Python. Not only was I using Python, I was using simple, operating system level Python. Why? Because in a real world situation, your Numpy will break, your Pandas will break, you will not need to plot anything, your fancy analysis scripts will stay tucked away at home. Practical scripts require simplicity to be robust.

Admin at 20:37, 19 August 2015

2015-08-19T20:37:38Z

← Older revision		Revision as of 20:37, 19 August 2015
Line 3:		Line 3:
	=Python=		=Python=

	First, I was using Python. Not only was I using Python, I was using simple, operating system level Python. Why? Because in a real world situation, your Numpy will break, your Pandas will break, you will not need to plot anything, your fancy analysis scripts will stay tucked away at home. Practical scripts require simplicity to be robust.		First, I was using Python. Not only was I using Python, I was using simple, operating system level Python. Why? Because in a real world situation, your Numpy will break, your Pandas will break, you will not need to plot anything, your fancy analysis scripts will stay tucked away at home. Practical scripts require simplicity to be robust. Can you run your tools immediately after you reinstall your operating system?

Admin: Created page with "How to go from a list of John the Ripper password files to a cracked password or two? =Python= First, I was using Python. Not only was I using Python, I was using simple, op..."

2015-08-19T20:37:23Z

Created page with "How to go from a list of John the Ripper password files to a cracked password or two? =Python= First, I was using Python. Not only was I using Python, I was using simple, op..."

New page

How to go from a list of John the Ripper password files to a cracked password or two?

=Python=

First, I was using Python. Not only was I using Python, I was using simple, operating system level Python. Why? Because in a real world situation, your Numpy will break, your Pandas will break, you will not need to plot anything, your fancy analysis scripts will stay tucked away at home. Practical scripts require simplicity to be robust.