1. Crack Linux Password Hash John The Ripper
2. Crack Htpasswd John The Ripper Linux Server
3. Crack Htpasswd John The Ripper Linux Command

This will require super user privileges to perform. Sudo /usr/sbin/unshadow /etc/passwd /etc/shadow /passwords.txt. And the command to crack your Linux passwords is simple enough. To perform the crack execute the following: /usr/sbin/john -wordlist=/usr/share/wordlists/rockyou.txt /passwords.txt. Password cracking with John the Ripper on LinuxJohn the Ripper (hereby called John for brevity), it is a free password cracking tool written mostly in C.John. John the Ripper can also crack UNIX/Linux passwords. You need root access to your system and to the password (/etc/passwd) and shadow password (/etc/shadow) files. Perform the following steps for cracking UNIX/Linux passwords: Download the UNIX source files from www.openwall.com/john. John the Ripper is a favourite password cracking tool of many pentesters. There is plenty of documentation about its command line options. I’ve encountered the following problems using John the Ripper. These are not problems with the tool itself, but inherent problems with pentesting and password cracking in general.

In this post I will show you how you can crack passwords with John the Ripper. We will start off by collecting the hashes from a linux machine, then use the tool unshadow and at last crack the hashes with John the Ripper.

1 – Collect hashes from a Linux machine
We will start with collecting the hashes from the target machine. We will need both /etc/passwd and /etc/shadow. Save them to your Kali Linux machine, preferably on the desktop. It can be done with the following commands.
cat /etc/passwd > ~/Desktop/passwd.txt

cat /etc/shadow> ~/Desktop/shadow.txt

2 – Combine passwd and shadow with unshadow
Now we need to combine these two files into one. This can be done with the tool unshadow.
unshadow passwd.txt shadow.txt > hashtocrack.txt

3 – Crack with John
Now we are ready to crack the hashes. John can run in different modes. You can use wordlists or straight brute force. The method I will use in this example is wordlist mode since that is the most effective way. Brute forcing takes a lot of time and I recommend you to only use it as a last resort when your wordlists won’t crack the hashes. In this example we define the wordlist to use to the built in rockyou.txt.
john --wordlist=/usr/share/wordlists/rockyou.txt hashtocrack.txt

Crack Linux Password Hash John The Ripper

4 – Show cracked credentials
If you let john run you will be prompted with the credentials as soon as they have been cracked. In this example we can see that the the password for the user SuperAdmin was Password1.

We can also come back at a later time and check the credentials again by defining the unshadowed file and add the parameter –show.

Crack Htpasswd John The Ripper Linux Server

john hashtocrack.txt --show

Crack Htpasswd John The Ripper Linux Command

//Rickard