Introduction
Offline password recovery compares candidates against supplied hashes rather than attempting logins. Understanding the format, candidate set, and saved recovery state is essential for interpreting success or failure.
This lab provides one intentionally weak training hash and a tiny dictionary. You will run a bounded John dictionary recovery with its own pot and session, then show and save the account-linked result.
Recover a Supplied Weak Password Offline
In this step, you will use a small candidate list against a known training hash format, keeping recovery state separate from other exercises.
Enter Kali and select the supplied practice directory:
kali
cd /home/labex/project/password-practice
A password hash is a derived representation used to check a password without storing it as plain text. A salt helps make the same password produce different stored hashes. This exercise supplies an intentionally weak training password represented with the salted SHA512-crypt format; this is not the same format as a raw SHA-512 digest.
Read the supplied account-and-hash file:
cat hashes.txt
The line begins with the training account name, a colon, and a hash beginning $6$. The salt and derived value are parts of the stored representation. You do not need to generate or edit the hash.
Inspect the small candidate list:
cat candidates.txt
Each line is one possible password. A dictionary recovery tests these candidates offline against the supplied hash. It does not send login attempts to a network service.
John is a password-recovery tool. --format=sha512crypt explicitly selects the supplied format, --wordlist=candidates.txt selects the candidate file, and --pot=guided.pot keeps recovered results in a dedicated pot file. --session=guided-session names this run's recovery session rather than mixing it with an unrelated session:
john --format=sha512crypt --wordlist=candidates.txt --pot=guided.pot --session=guided-session hashes.txt
Wait for the run to finish. The output should report one recovered password. Exact performance numbers and thread messages vary. A pot file stores recovered hash/password mappings, so repeating a run with the same pot may skip already recovered hashes; that does not prove a new attempt recovered them again.
A dictionary run can fail because the candidate is absent, the selected format is wrong, or the input is malformed. An unsuccessful run is not proof that a password is impossible to recover.
Show and Preserve the Verified Recovery Result
In this step, you will read recovery state with John and save an account-linked result for review.
Stay in the same practice directory. John's --show mode checks the supplied hash file against the selected pot and displays recovered account/password results:
john --show --format=sha512crypt --pot=guided.pot hashes.txt
The account line should include training-user:cedar42, followed by a summary indicating one recovered hash and none left. The password is deliberately weak and appears in the supplied candidate list.
Save this verified view instead of hand-writing a claim that recovery succeeded:
john --show --format=sha512crypt --pot=guided.pot hashes.txt > recovered.txt
cat recovered.txt
The saved file should retain the account-linked result and recovery summary. Keep the supplied hashes, the candidate list, and the dedicated pot together so the result can be checked against the exact training data.
These results contain plain-text training credentials. In real work, recovered passwords are sensitive evidence and belong only in the authorized workflow. This exercise does not ask you to test a real account or reuse its demonstration password.
Summary
You distinguished hashes, salts, and plain text; ran an offline dictionary recovery with an explicit format; isolated its pot and session; and saved the result produced by show mode. You interpreted recovery as evidence about a specific supplied hash and candidate set.
