*Password Tips/Tools

Recommended Tools:

  • Online Crackers
  • Tools built into BackTrack & Kali (like John & Hydra)
  • John the Ripper – built into BackTrack & Kali
    1. Create the file with the hash (or hashes)
      • #gedit hashfile (to create the file with the hashes)
    2. Run john against the hash file using a wordlist
      • To use John’s built-in wordlist
        • #john /root/hashfile
      • To use rockyou wordlist
        • #john /root/hashfile –wordlist:/usr/share/wordlists/rockyou.txt
      • To specify the type of hash to crack (example uses md5)
        • #john /root/hashfile –format=RAW-md5
        • #john /root/hashfile –wordlist:/usr/share/wordlists/rockyou.txt –format=raw-md5
    3. To view hashes that have already been cracked
      • #cat /root/.john/john.pot
    4. To erase hashes that have already been cracked
      • #gedit /root/.john/john.pot
    5. If you get an crash recovery error that john.rec is locked)
      • #rm /root/.john/john.rec
  • Wordlists
    • rockyou.txt (available in BackTrack & Kali)
      • /usr/share/wordlists/rockyou.txt
    • Build your own manually
      • gedit customwordlist
      • Enter all the possible words you want use, Save, close
      • #john /root/hashfile –wordlist:/root/customwordlist
    • Use Crunch to build the list if you have a predefined character set
      • https://tools.kali.org/password-attacks/crunch
      • Example – To make a list of AACC123 (AACC followed by 3 numbers)
        • #crunch 8 8 0123456789 -t AACC%%% -o /root/aaccwordlist
      • -t Specifies a pattern
        • @ will insert lower case characters
        • , will insert upper case characters
        • % will insert numbers
        • ^ will insert symbols
      • -o specifies where you want to save your wordlist
    • Use a CeWL to build a wordlist using words off a website
      • #cewl -d 0 -w /root/wordlist http://webiste.com
      • #john /root/hashfile –wordlist:/root/wordlist
  • Cracking passwords on ZIP files
    • fcrackzip -D -p /usr/share/wordlists/rockyou.txt -u /path/nameofzipfile

Leave a Reply