John The Ripper

John the Ripper

Purpose

Use this skill for offline password auditing when the engagement explicitly permits analysis of captured or provided password hashes.

Phase Fit

• Primary: Validation and Controlled Impact Demonstration
• Secondary: Vulnerability Analysis, Retest and Closure

Use When

• Need to assess password strength from approved offline hashes.
• Need to validate policy weakness without online authentication attempts.
• Need a repeatable retest after password hardening changes.

Avoid When

• Hashes were not obtained or provided under explicit authorization.
• The engagement does not permit offline password analysis.

Inputs

• Approved hash file or hash subset
• Expected format and approved wordlist or rules
• Evidence handling rules for credential material

Procedure

1. Confirm that the hash set is authorized for offline analysis.
2. Start with the narrowest relevant wordlist or mode.
3. Record only the minimum evidence needed to show policy weakness.
4. Avoid over-collecting recovered credentials.
5. Preserve the exact cracking mode for retest.

Command Syntax

Replace sample paths with approved hash files and approved wordlists.

# Crack with wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt contoso-hashes.txt

# Apply transformation rules to wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt --rules=Jumbo contoso-hashes.txt

# Crack NTLM hashes
john --format=NT --wordlist=/usr/share/wordlists/rockyou.txt contoso-ntlm.txt

# Crack Kerberos TGS (Kerberoast)
john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt contoso-tgs.txt

# Crack AS-REP hashes
john --format=krb5asrep --wordlist=/usr/share/wordlists/rockyou.txt contoso-asrep.txt

# Show cracked passwords
john --show contoso-hashes.txt

# Show cracked in specific format
john --show --format=NT contoso-ntlm.txt

Evidence to Capture

• Whether weak passwords were recoverable from the approved set
• Hash format and cracking mode used
• Policy-relevant observations without unnecessary credential exposure

Safety Boundaries

• Keep all recovered material tightly controlled.
• Do not use recovered credentials outside the approved engagement scope.