Tryhackme vulnversity walkthrough

 Hello, everybody, and welcome to the Mr. Ethical YT blog! If you've got an interest in learning about "how to crack passwords using John the Ripper," well, this happens to be the right location. Let us look, then, into the workings of John the Ripper-the most famous password cracking software in the world.

Before we go any further, it is imperative to reiterate that the cracking of passwords raises ethical issues. This information applies to educational purposes only. It is for use in controlled environments like penetration testing with the explicit permission of the system owner, or for recovering one's own forgotten passwords. Unauthorized cracking of passwords can be considered illegal, and it can severely punish you in some jurisdictions. 

John the Ripper is every security guru's best companion for testing password strength, disclosing vulnerabilities, and recovering credentials. The tool employs various techniques of cracking systems, these being dictionary attacks, brute-force attacks, and hybrid attacks.

This blog will describe the history of John the Ripper, its installation, its basic use, modes of cracking, and mainly ethical and responsible use of the tool.

While these are characeristics that security specialists need to use, remember that cracking of passwords is only a means to better secure all other areas of life.

We want to go over the technical setup procedure for John the Ripper and give examples and explanations along the way so you know the sweetness. Just remember: with sweet knowledge comes responsibility and ethics."

What is John the ripper

The John the Ripper is a free password guessing (CR4CKING) software tool.It was originally developed for the Unix os(operating system), it can be run on fifteen different platforms (eleven of which are particular architecture versions of Unix, DOS, Win32, BeOS, and OpenVMS). It is among the most frequently used password testing and breaking programs as it amalgamate a number of password crackers into the one package, autodetects password hash types, and includes a customizable cracker. It can be run against various types of encrypted password formats including several crypt password hash types most commonly found on various Unix versions (based on MD5,DES, or Blowfish), Kerberos AFS, and Windows NT/2000/XP/2003 LM hash. Additional modules have the extended its ability to include MD4-based password hashes and the passwords stored in LDAP, MySQL, and others.

Installation of John the ripper

Download termux from F-droid.Update and upgrade it

apt-get update && apt-get upgrade

Install the proot-distro 

apt install proot-distro

Now let's install the ubuntu by running the command given below

proot-distro install ubuntu 

After installing the ubuntu login into ubuntu by the command of

proot-distro login ubuntu

 By running the above command you will login into ubuntu.Use logout command to logout from ubuntu

logout 

Go to bin directory

cd $PREFIX/bin 

run nano command here

nano

Paste this command there 

proot-distro login ubuntu

Then save it by CTRL^S it will ask you for a name give ubuntu there and CTRL^ X to exit 

Now you don't need run proot-distro login ubuntu everytime just run ubuntu

ubuntu 

 

Install the all these recommended packages "git build-essential libssl-dev libbz2-dev zlib1g-dev yasm pkg-config libgmp-dev libpcap-dev  " 

apt-get install git  libssl-dev zlib1g-dev yasm pkg-config libgmp-dev build-essential libpcap-dev libbz2-dev 

 Then clone the repository of John the ripper using git. 

git clone https://github.com/openwall/john

Change working directory to john/src 

cd john/src

give executable permissions to all files 

chmod +x * 

run the configure file 

./configure 

This will take a while waint until it's get finished 

After it's get finished run this command 

make -s clean && make -sj4

 We have successfully installed John the ripper. let's crack the password of a encrypted zip file 

For testing purpose I have encrypted a zip file with password 123321 

We need a wordlist dictionary  iam using rockyou.txt you can download this from GitHub or you can use any preferred wordlist you like . The wordlist is very important you can create wordlist based on your requirements the better the wordlist is the better chances of cracking the password.

change working directory to john/run 

cd home 

cd john/run

Then run this command 

./zip2john /pathToYourZipFile > hash.txt

This will extract the password hash from your zip file and save it hash.txt file. To crack the password run the command given below

./john hash.txt

It will start the cracking process wait until the password gets cracked if the password is in the wordlist it crack the password ,if it didn't crack the password change the wordlist or create a new word list based on your assumption about the file.

In the above image you can see cracked password. If you see I have set a simple password that's why it's get cracked fast . It's recommend to always use strong passwords in order to prevent from being hacked