Introduction
John the Ripper (JtR) is a popular open-source password cracking tool. While the standard version is powerful, the "Jumbo" version extends its capabilities significantly by adding support for many more hash types, cracking modes, and utilities. This lab will guide you through installing John the Ripper Jumbo and exploring its enhanced features. You will learn how to identify new supported hash formats, utilize advanced cracking modes, and discover additional tools that come with the Jumbo package. By the end of this lab, you will have a solid understanding of how John the Ripper Jumbo can be used for more comprehensive password auditing and recovery tasks.
Install John the Ripper Jumbo
In this step, you will install John the Ripper Jumbo from its official GitHub repository. This involves cloning the repository, navigating into the source directory, and compiling the software.
First, open your terminal. Ensure you are in the ~/project directory.
cd ~/project
Now, clone the John the Ripper Jumbo repository:
git clone https://github.com/openwall/john-the-ripper.git
Navigate into the john-the-ripper/src directory:
cd john-the-ripper/src
Compile John the Ripper Jumbo. We will use make clean && make -s to ensure a clean build and suppress verbose output for a cleaner terminal.
make clean && make -s
After compilation, the john executable will be located in the ~/project/john-the-ripper/run directory. You can verify the installation by checking its version.
~/project/john-the-ripper/run/john --version
You should see output similar to this, indicating the Jumbo version:
John the Ripper 1.9.0-jumbo-1 (linux-gnu 64-bit x86_64 AVX2)
Copyright (c) 1996-2023 by Solar Designer and others
...
Identify New Hash Formats Supported by Jumbo
In this step, you will explore the extensive list of hash formats supported by John the Ripper Jumbo. The Jumbo version significantly expands the number of crackable hash types compared to the standard version.
To list all supported hash formats, use the --list=formats option with the john executable. Since the output is very long, we will pipe it to less for easier viewing.
~/project/john-the-ripper/run/john --list=formats | less
Press q to exit less after reviewing the list.
You can also filter the list to find specific hash types. For example, to see formats related to bcrypt, you can use grep:
~/project/john-the-ripper/run/john --list=formats | grep -i bcrypt
You should see output similar to this, showing various bcrypt formats:
bcrypt, bcrypt-opencl, bcrypt-cuda
This demonstrates how Jumbo supports a wider array of modern and complex hash types, making it more versatile for password auditing.
Utilize New Cracking Modes in Jumbo
In this step, you will learn about some of the new cracking modes available in John the Ripper Jumbo. Jumbo introduces advanced cracking techniques and optimizations that can improve cracking efficiency.
One of the powerful features is the ability to use wordlists with rules. Let's create a simple password file and a wordlist to demonstrate a basic cracking attempt.
First, create a file named passwords.txt with a sample hash. We'll use a simple MD5 hash for demonstration.
echo "user1:21232f297a57a5a743894a0e4a801fc3" > ~/project/passwords.txt
The hash 21232f297a57a5a743894a0e4a801fc3 corresponds to the password admin.
Next, create a simple wordlist named wordlist.txt:
echo -e "password\nadmin\n123456" > ~/project/wordlist.txt
Now, try to crack the hash using the wordlist mode.
~/project/john-the-ripper/run/john ~/project/passwords.txt --wordlist=~/project/wordlist.txt
You should see output indicating the password has been cracked:
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5])
Cost 1 (iteration count) is not supported for this hash type.
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
admin (user1)
1g 0:00:00:00 DONE (2023-10-27 08:00) 100.0g/s 100.0p/s 100.0c/s 100.0C/s admin
Session completed.
To show the cracked password, use the --show option:
~/project/john-the-ripper/run/john ~/project/passwords.txt --show
Output:
user1:admin
1 password hash cracked, 0 left
This basic example demonstrates the wordlist mode. Jumbo also supports more complex modes like incremental mode with character sets, external modes, and more, which you can explore further using the documentation.
Explore Additional Utilities in Jumbo
In this step, you will explore some of the additional utilities that come bundled with John the Ripper Jumbo. These utilities are designed to assist in various aspects of password auditing, such as preparing password files or generating wordlists.
One useful utility is unshadow, which combines /etc/passwd and /etc/shadow files into a format that John the Ripper can process. While we won't modify system files, we can simulate its usage.
Another important utility is unique, which can filter out duplicate entries from a wordlist. Let's create a wordlist with duplicates and then use unique to clean it.
Create a file named duplicate_wordlist.txt:
echo -e "apple\nbanana\napple\norange\nbanana" > ~/project/duplicate_wordlist.txt
Now, use the unique utility, which is located in the run directory, to remove duplicates:
~/project/john-the-ripper/run/unique ~/project/duplicate_wordlist.txt
The output should show only unique words:
apple
banana
orange
This demonstrates how unique can be used to refine wordlists, which is crucial for efficient cracking. You can find other utilities in the ~/project/john-the-ripper/run directory.
Compare Jumbo with Standard John the Ripper
In this step, you will understand the key differences and advantages of John the Ripper Jumbo compared to the standard version. While the standard version is a solid tool, Jumbo offers significant enhancements.
The primary advantages of Jumbo include:
- Extended Hash Support: Jumbo supports a much wider array of hash types, including many modern and application-specific hashes that the standard version does not. This was demonstrated in Step 2.
- Optimized Performance: Jumbo often includes optimized cracking algorithms and better utilization of hardware (like GPUs via OpenCL/CUDA, though not covered in this lab) for faster cracking.
- Additional Utilities: As seen in Step 4, Jumbo bundles several helper utilities that streamline the password auditing process.
- Active Development: The Jumbo version typically receives more frequent updates and new features from the community.
To summarize, if you are serious about password auditing or recovery, the Jumbo version of John the Ripper is almost always the preferred choice due to its expanded capabilities and active development. The standard version might be sufficient for basic tasks, but Jumbo provides a more comprehensive and up-to-date toolkit.
You have successfully installed John the Ripper Jumbo, explored its new hash format support, utilized a basic cracking mode, and discovered one of its additional utilities. This lab has provided a foundational understanding of the enhanced features offered by the Jumbo version.
Summary
In this lab, you successfully installed John the Ripper Jumbo from its source code, demonstrating the process of compiling a powerful security tool. You then explored its extensive support for various hash formats, highlighting Jumbo's versatility in handling different types of password hashes. You also gained hands-on experience using one of its cracking modes by cracking a sample MD5 hash with a wordlist. Furthermore, you discovered and utilized an additional utility, unique, which helps in preparing wordlists for more efficient cracking. Finally, you understood the key advantages of the Jumbo version over the standard John the Ripper, emphasizing its broader hash support, performance optimizations, and bundled utilities. This lab has equipped you with practical skills and knowledge to leverage John the Ripper Jumbo for advanced password auditing and recovery tasks.
