So there is brute force going applications, but sometimes you just have a password hash, so all we
can do is actually try to crack the password, you know, with an application called John.
So it's another application and clinics that you can use for cracking the password hash, you know,
if that's all that you have.
So if you have a good list of password hashes or a good word list, you could typically crack the password
hash, you know, using John.
So let's actually go and try to do this.
OK, so back in the car, a Linux machine.
So what?
Let's go ahead and try to use John.
So the first thing that we have to do is actually unsaddle the password.
So let's say, for example, we had a root access to our Maspero machine.
All we do is copy the contents of the HTC Shadowfax folder into a file and also slide past.
It would fall into a folder and prayers with these files are they correlate to your passwords and your
password hashes for like analytics accounts.
And this is typically what you'll see when it comes to Linux systems.
You can go ahead and look at those files just to get an idea of what it looks like.
So you see a shadow.
So this has a hash hashes in there and you can see the ones that have these super long was actually
have passwords on them.
So I created this user called victim.
And we're going to try to do is actually try to crack the hash for their password.
So what we can do is actually to show you locally we're going to imagine that we copy the contents of
the of the folder of the those files over to our system and put them in the file so all we can do locally
is right here.
So EDC see past the videos and then he sees a shadow and then we're going to output this.
It's in my past that reads that text.
So this is going to unsaddle the password hashes and actually compile into this.
My pastor reads that text file.
So we go ahead and enter and now that's done and we get to do it else and check to see that the file
is there.
So we see that it is.
So now what you want to do is actually have a word list that you want to use with this world.
This is going to be used for is actually to create hashes.
Incorporating is the hashes that we just made from and shadow.
The already made one is very quick.
Just I just need a list.
I mean I just need to list.
So we used to have list, just look at it.
Sort of a password.
Password once, the password once.
So it's going to go to these and actually try to convert it to a hash to the hash and it's going to
attempt to compare it to the hashes that we supplied it into my past, the text file, and it's going
to find a match for the password that way.
So if we want to actually use John, we're just going to have John Dash.
That's where lists equals list.
And then we're going to put the file that we had also on past the meds that to exceed.
So this is the command that we're going to use and go ahead and enter and it's going to go through.
It's going to run it.
It's very quick because we don't have any password, many passwords for it to go through.
But what we can do is to see, you know, what exactly, if anything, we can do on that show and then
actually put my past DVDs that text file and see if it cracked any passwords from that file.
So actually, right there, bam, we see that we crack the password for the victim, file for the user,
and we see that their password is password one exclamation point.
So we will be able with some log in to the system with that password.
So John is very, very powerful and is a lot of different things that you could do, like setting different
rules and such.
And it's pretty complex.
So you can go ahead and check out John and try to use that and play with this song and try to crack
some password issues.