WEBVTT 00:00:00.040 --> 00:00:02.590 I want to spend a few moments talking about password lists. 00:00:03.230 --> 00:00:06.310 Password lists contain multitudes of commonly‑used passwords. 00:00:06.940 --> 00:00:10.320 Many of these lists contain passwords from data leaks, 00:00:10.320 --> 00:00:11.860 which have been published publicly. 00:00:12.310 --> 00:00:16.550 You will be surprised how often those leaked passwords are still being used. 00:00:17.440 --> 00:00:19.460 By using a password list with John the Ripper, 00:00:19.800 --> 00:00:23.600 it'll increase your chances of success in cracking a specific hash. 00:00:23.930 --> 00:00:26.950 There are a number of password lists that are available on the internet. 00:00:27.480 --> 00:00:32.080 My favorites are those that are found in SecLists, Crackstation, and Weakpass. 00:00:32.750 --> 00:00:33.590 In this course, 00:00:33.600 --> 00:00:35.980 we will leverage the password lists that are available 00:00:35.980 --> 00:00:38.320 from SecLists with John the Ripper. 00:00:38.320 --> 00:00:40.350 Alright, so now it's time for our first demo, 00:00:40.570 --> 00:00:44.190 and in this demo, we will take a quick look at the syntax for John the Ripper. 00:00:44.730 --> 00:00:47.060 We will then look at the supported ciphers that 00:00:47.060 --> 00:00:48.550 John the Ripper is able to crack, 00:00:49.390 --> 00:00:51.850 and we will get started with downloading a repository 00:00:51.850 --> 00:00:55.640 of password lists from SecLists, which we will use in the course. 00:00:56.010 --> 00:00:58.040 Alright, so now I'm in my Kali Linux machine, 00:00:58.060 --> 00:00:59.710 and I've opened up a terminal window. 00:00:59.990 --> 00:01:01.550 I'm going to issue the command john, 00:01:01.560 --> 00:01:04.379 which will then give me a list of available options that's 00:01:04.379 --> 00:01:06.650 available to use with John the Ripper. 00:01:07.410 --> 00:01:11.490 I'm using version 1.9.0, and I'm using the jumbo release. 00:01:11.990 --> 00:01:14.720 The jumbo release gives me the ability to leverage a lot 00:01:14.730 --> 00:01:17.200 more ciphers that John is able to crack. 00:01:17.500 --> 00:01:22.200 Of course, John has a man page, which is accessible using the command man john, 00:01:22.540 --> 00:01:25.510 and this will give you a more in‑depth description of each of the 00:01:25.510 --> 00:01:27.500 options that's available for John the Ripper. 00:01:27.710 --> 00:01:30.780 Now let's take a look at the list of ciphers that John is able to crack. 00:01:31.190 --> 00:01:33.450 And to do this, I'm going to issue the command john, 00:01:33.490 --> 00:01:36.280 with the option of list, looking at the formats. 00:01:37.020 --> 00:01:38.140 You can see from the list, 00:01:38.400 --> 00:01:40.950 there's quite a number of hash types that are supported by 00:01:40.950 --> 00:01:42.550 the jumbo version of John the Ripper. 00:01:43.040 --> 00:01:45.300 Okay, so now it's time to add our password list, 00:01:45.300 --> 00:01:49.730 and to do this, I'm going to use the list that's available from SecLists, 00:01:49.890 --> 00:01:52.230 and this is obtainable from the GitHub repository, 00:01:52.380 --> 00:01:54.840 and we'll take a look at how we can install this in a minute, 00:01:54.840 --> 00:01:58.380 but I'd like to just cover a few points on this repository. 00:01:58.610 --> 00:02:02.470 You can see that they are number of categories that's available that I can use. 00:02:03.270 --> 00:02:05.190 Just taking a look at passwords, for example, 00:02:05.640 --> 00:02:08.650 I've got a list of cracked hashes, leaked databases, 00:02:08.650 --> 00:02:10.610 permutations, and a lot more. 00:02:11.410 --> 00:02:15.370 So using this within John the Ripper will increase my chances of success. 00:02:15.840 --> 00:02:18.950 Let's get this repository installed on a Kali Linux machine. 00:02:19.510 --> 00:02:22.410 A quick way to do that is to open up the terminal window and 00:02:22.410 --> 00:02:25.490 issue the command apt install seclists. 00:02:26.140 --> 00:02:29.910 This will go out and download the entire repository onto your machine, 00:02:30.230 --> 00:02:33.750 giving you the ability to leverage all of the password list that's available. 00:02:34.320 --> 00:02:35.710 Once the download is completed, 00:02:35.990 --> 00:02:40.530 you will have a copy of the repository in the usr/share/seclists folder. 00:02:40.950 --> 00:02:43.450 To view this, you can use the command ls, 00:02:43.450 --> 00:02:47.070 followed by usr/share/seclists, 00:02:47.590 --> 00:02:49.720 and you'll see that we have a list of the various 00:02:49.720 --> 00:02:53.400 categories and the password lists within each category that 00:02:53.400 --> 00:02:55.440 we can leverage with John the Ripper. 00:02:55.440 --> 00:02:58.450 John the Ripper makes use of wordless rules to perform 00:02:58.450 --> 00:03:00.590 word mangling on your word list. 00:03:01.060 --> 00:03:01.780 In essence, 00:03:01.910 --> 00:03:04.880 it gives you the ability to create multiple additional 00:03:04.880 --> 00:03:08.020 words based on the rule that you may have. 00:03:08.370 --> 00:03:11.550 The wordlist rules are defined in the config file of John the Ripper. 00:03:12.230 --> 00:03:16.310 The config file is found under the john directory in the etc folder. 00:03:16.620 --> 00:03:18.350 Let's take a look at what this looks like. 00:03:18.920 --> 00:03:21.760 To view the config file, we'll use the command nano, 00:03:21.770 --> 00:03:23.700 followed by the path of the config file. 00:03:24.210 --> 00:03:26.460 The config file might seem overwhelming at first, 00:03:26.470 --> 00:03:29.430 but don't despair, there are tons of comments within this file, 00:03:29.440 --> 00:03:32.440 which will give you a clear description of what each option does. 00:03:33.920 --> 00:03:36.310 The config file of John the Ripper enables you to 00:03:36.310 --> 00:03:39.150 configure multiple options on how John works. 00:03:39.450 --> 00:03:42.990 One specific section that I would like to talk about is the one where you can 00:03:42.990 --> 00:03:46.790 configure multiple options for word mangling on word lists. 00:03:46.830 --> 00:03:52.030 I will search for the section under list.Rules Wordlist. You will 00:03:52.030 --> 00:03:54.450 notice in this section that there is a lot of commands. 00:03:55.040 --> 00:03:57.290 These commands are detailed on Openwall's website. 00:03:58.070 --> 00:04:02.210 This specific rule performs permutations on a word list. 00:04:02.400 --> 00:04:04.550 Let's try this rule on a sample word list. 00:04:04.880 --> 00:04:10.020 I currently have a file, which is called rockyou‑05.txt. This 00:04:10.020 --> 00:04:12.360 file has an unlimited number of passwords. 00:04:12.500 --> 00:04:16.640 You can see the word count is only 13. To show you what's 00:04:16.640 --> 00:04:19.660 inside, it's a very basic list of passwords. 00:04:20.110 --> 00:04:24.000 Now let's take a look at how John can use this simple word list with 00:04:24.000 --> 00:04:27.530 the help of the mangling rules that we've looked at the config file 00:04:27.930 --> 00:04:29.980 to create a more complex word list. 00:04:30.180 --> 00:04:32.170 To do this, I'm going to issue the command john, 00:04:32.320 --> 00:04:36.400 followed by the wordlist option, which I will define my word list, 00:04:36.400 --> 00:04:37.610 which I went to mangle. 00:04:38.340 --> 00:04:40.310 I'm going to use the rules option, 00:04:40.740 --> 00:04:45.290 and I'm going to define the rule called wordlist. Now keep in mind this 00:04:45.300 --> 00:04:48.980 wordlist rule is the one that we've seen in the john.config file. 00:04:50.030 --> 00:04:53.290 I'm going to perform a standard output, 00:04:53.450 --> 00:04:58.170 and I'm going to pipe this into a new version of my current word list, 00:04:58.370 --> 00:05:03.360 which I'm going to call rockyou‑v2.txt. You'll notice that the 00:05:03.360 --> 00:05:06.250 word‑mangling process completed relatively quickly. 00:05:06.610 --> 00:05:11.270 This is because my source word list only has 13 passwords. Of course, if you 00:05:11.270 --> 00:05:15.110 have a much larger source word list, the time it would take to compute would 00:05:15.120 --> 00:05:18.200 be a lot more. Now if I take a look at the files that I currently have, 00:05:18.200 --> 00:05:20.630 let's do a word count on the new file, 00:05:20.690 --> 00:05:23.870 which I've mangled using John the Ripper. I'm going to 00:05:23.870 --> 00:05:27.610 issue the command word count for the new file. And you can 00:05:27.610 --> 00:05:30.400 see right now I've got 358 words. 00:05:30.930 --> 00:05:33.150 If I do a quick view of that file, 00:05:34.450 --> 00:05:39.460 you will notice that now that initial basic 13‑password file 00:05:39.820 --> 00:05:43.740 has been mangled and permutated based on the rule which was 00:05:43.740 --> 00:05:45.100 defined in the config file.