John the ripper
阿新 • • 發佈:2020-07-20
John是一個破解系統密碼的工具。
引數
John the Ripper 1.9.0-jumbo-1 OMP [linux-gnu 64-bit x86_64 AVX AC] Copyright (c) 1996-2019 by Solar Designer and others Homepage: http://www.openwall.com/john/ Usage: john [OPTIONS] [PASSWORD-FILES] --single[=SECTION[,..]] "single crack" mode, using default or named rules --single=:rule[,..] same, using "immediate" rule(s) --wordlist[=FILE] --stdin wordlist mode, read words from FILE or stdin --pipe like --stdin, but bulk reads, and allows rules --loopback[=FILE] like --wordlist, but extract words from a .pot file --dupe-suppression suppress all dupes in wordlist (and force preload) --prince[=FILE] PRINCE mode, read words from FILE --encoding=NAME input encoding (eg. UTF-8, ISO-8859-1). See also doc/ENCODINGS and --list=hidden-options. --rules[=SECTION[,..]] enable word mangling rules (for wordlist or PRINCE modes), using default or named rules --rules=:rule[;..]] same, using "immediate" rule(s) --rules-stack=SECTION[,..] stacked rules, applied after regular rules or to modes that otherwise don't support rules --rules-stack=:rule[;..] same, using "immediate" rule(s) --incremental[=MODE] "incremental" mode [using section MODE] --mask[=MASK] mask mode using MASK (or default from john.conf) --markov[=OPTIONS] "Markov" mode (see doc/MARKOV) --external=MODE external mode or word filter --subsets[=CHARSET] "subsets" mode (see doc/SUBSETS) --stdout[=LENGTH] just output candidate passwords [cut at LENGTH] --restore[=NAME] restore an interrupted session [called NAME] --session=NAME give a new session the NAME --status[=NAME] print status of a session [called NAME] --make-charset=FILE make a charset file. It will be overwritten --show[=left] show cracked passwords [if =left, then uncracked] --test[=TIME] run tests and benchmarks for TIME seconds each --users=[-]LOGIN|UID[,..] [do not] load this (these) user(s) only --groups=[-]GID[,..] load users [not] of this (these) group(s) only --shells=[-]SHELL[,..] load users with[out] this (these) shell(s) only --salts=[-]COUNT[:MAX] load salts with[out] COUNT [to MAX] hashes --costs=[-]C[:M][,...] load salts with[out] cost value Cn [to Mn]. For tunable cost parameters, see doc/OPTIONS --save-memory=LEVEL enable memory saving, at LEVEL 1..3 --node=MIN[-MAX]/TOTAL this node's number range out of TOTAL count --fork=N fork N processes --pot=NAME pot file to use --list=WHAT list capabilities, see --list=help or doc/OPTIONS --format=NAME force hash of type NAME. The supported formats can be seen with --list=formats and --list=subformats
翻譯
john系統自帶密碼路徑
/usr/share/john/password.lst
爆破過程
如果不指定字典的話,會使用john系統自帶的password.lst字典
一個注意事項
john工具對於同一個shadow檔案只會進行一次爆破,如果第二次執行john shadow是不會得到結果的,只會得到如下輸出。
Warning: detected hash type "md5crypt", but the string is also recognized as "md5crypt-long" Use the "--format=md5crypt-long" option to force loading these as that type instead Using default input encoding: UTF-8 Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 128/128 AVX 4x3]) No password hashes left to crack (see FAQ)
如果想檢視上一次爆破的結果,可以使用以下命令。
root@kali:~# john --show password
frank:frank!!!