How to crack passwords, and why you should

COMMENT

Auditing passwords is a worthwhile venture, particularly in an environment that deals with sensitive information. Because systems encrypt passwords when they store them, you really can't properly judge the strength of a password unless you try to crack it.

We suggest using a password-cracking tool such as John the Ripper. This tool works extremely well because it can crack MD5 passwords, which most systems currently use. In addition, it's much faster and more sophisticated than earlier password-cracking software such as Crack.

Once you've installed the tool, either from RPM or by compiling a copy yourself, you can set it to work. Keep in mind that John the Ripper uses a fair amount of CPU, but it will only use idle CPU time. However, copying the /etc/shadow file to a nonessential machine and running the tool on that, rather than a production machine, wouldn't be a bad idea either.

If you need to stop John the Ripper, press Ctrl+C. You can resume cracking passwords from where you left off by using the following:

$ john -restore

This tool comes with a fair-sized dictionary of common passwords, which it uses by default. However, you can download any dictionary you want to use instead of, or as complement to, the existing dictionary. All you need to do is concatenate the default.lst file to the new dictionary.

In addition, it's a good idea to add words that are specific to your particular environment, including employee names, addresses, company name, etc.

To use a different dictionary than the default, use the following:

# john -wordfile:/tmp/dict.txt /etc/shadow

This runs John the Ripper against the passwords in /etc/shadow using the dictionary /etc/dict.txt.

To download the John the Ripper password cracker, visit the Openwall Project Web site.

Talkback

Having pressed on the link and tried to download the 'John the Ripper' program, my PC Antivirus (NOD32) alarms and reports that the file is a trojan.

Lets hope other unsuspecting people who are not IT literate dont install this program.

Great idea to put a link to a trojan on your website!!!!

Keep up the good word ZDNet. Please ensure you put a warning on the page to alert people and in future CHECK sources are legit.

1 Jun 05 09:01 Reply

Thats essentially an Antivirus for windows

1 Jun 05 09:19 Reply

Or you could just enforce complexity and password length along with password history.

1 Jun 05 14:46 Reply

If I'm willing to give you my password in exchange for a coupon for a cup of coffee, does it really matter how "complex" it is?

You have to wonder how many of the people who sold their passwords so cheaply did it as a way of getting back at IT security departments who'd made their lives a misery for so long.

1 Jun 05 23:12 Reply

I doubt anybody actually gave them real passwords...or gave them to "spite" an IT department. Most people don't live under such a jaded mindset as yourself. But if somone was going to give me some STarbucks for "my" password. I would come up with yet another one of "my" passwords and give it to them.

That was an insanely stupid test. Even so, back to the point of the article -- if you are cracking and revealing passwords and then somebody else knows the passwords (the pasword cracker) then why not give them away because then they are useless. Thus cracking passwords is contradictory to the spirirt of most corporate policies that forbid giving somebody else your password.

2 Jun 05 16:10 Reply

yes, yes, this is all good and well, and having downloaded this program "John the Ripper" about 5 times and trying to instal it about 17 times, i wonder why i even bothered. it's all great and lovely that it works for you, but what about the rest of us? i am at a complete loss as to how to install this thing. yes, i read the readme and install stuffs, but aparrently the files i needed weren't downloaded. i probably sound stupid and ignorent but i'm slightly agitated that it's not working for me.

28 Jun 05 02:02 Reply

I want to crack program with protoctoin
I need to learn how i can do?

17 Jul 05 17:28 Reply

Hello,
I'm Japanese. I'm not good at English.

The originap page(http://www.openwall.com/john/) with [John the Ripper 1.6 (Win32 - binaries, 763 KB)] with Trjyan.

Normal?? Abnormal??

Reading Thank you.

24 Oct 05 19:36 Reply