John the Ripper
is a general purpose password cracking application:
John the Ripper is a fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), DOS, Win32, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix flavors, supported out of the box are Kerberos AFS and Windows NT/2000/XP/2003 LM hashes, plus several more with contributed patches.
Version 1.7 of John
on February 9 by Solar Designer:
"John the Ripper became a lot faster, primarily at DES-based hashes.
This is possible due to the use of better algorithms (bringing more
inherent parallelism of trying multiple candidate passwords down to
processor instruction level), better optimized code, and new hardware
capabilities (such as AltiVec available on PowerPC G4 and G5 processors)." This is the first release that is not considered
a development snapshot.
Version 1.7 of John also adds better use of x86 MMX hardware,
improved vectorization support, an event
logging framework, new build targets, and more.
Compiling a working version of John was a simple matter of downloading
the source code, reading the installation documentation, and running
a make command with the specified computer architecture.
The passwd file and shadow file, with the encrypted passwords, were
combined into a working password file using the supplied unshadow
command. John was then run with the unshadowed password file.
Decryption is a compute-intensive operation, it would be
advisable to run John on the fastest system you have access to, and import
password files to that machine.
I did a test run John on my new 3Ghz Athlon 64 Lini box,
it quickly spit out the default password for the default gvuser
account, then proceeded to crank heavily (near 100% cpu utilization)
for a long time with no further output. John had amassed nearly an
hour of CPU time by the time I finished this article.
John should be considered an important utility for any systems
administrator's collection of tools. It found a weak password on
my system (since changed) and will be useful for testing other
password files for weak points. Administrators with Internet-exposed
or otherwise accessible machines would be advised to give this handy
utility a spin.
to post comments)