Practical 10: Password Cracking using John the Ripper and Hashcat

===== SOURCE: EH_PRAC10_Pass crack (1).docx =====

PRACTICAL NO:1
PASSWORD CRACKING USING JOHN RIPPER AND HASHCAT

John the Ripper jumbo supports hundreds of hash and cipher types, including for: user passwords of Unix flavors, macOS, Windows, groupware, and database servers; network traffic captures; encrypted private keys, filesystems and disks, archives, and document files. 
John the Ripper (JtR) is a well-known open-source password security auditing and password recovery tool. It is commonly used by system administrators, penetration testers, and security researchers to identify weak passwords by attempting to crack password hashes 


Method 1: 
Visit the official downloads page:

 John the Ripper Downloads

Download the latest Windows binary (Jumbo edition) ZIP archive.
Extract it to a folder, for example: 
C:\Tools\John\
4. Open Command Prompt.
5. Change to the run directory:
cd C:\Tools\John\run
6.Once it's installed, you can explore its features using: 
john --help

7. Create a wordlist
Save the following as password.txt:

password1234
hehehe

jigigigigig

@@31283egfhecd

8. Save the hashes
Copy the generated hashes into hashes.txt
BDC87B9C894DA5168059E00EBFFB9077
FFE553694F5096471590343432359E02
0EC4773984E1CB4EDCF051249F141305

9. Run John 
john --format=raw-md5 --wordlist=words.txt hashes.txt
10. john --show –format=raw-md5 hashes.txt

OUTPUT:



CRACK LM PASSWORD:




HASHCAT

STEPS:
DOWNLOAD HASHCAT BINARIES  > EXTRACT IN DESKTOP > MAKE WORD.TXT AND HASH.TXT > SAVE THEM IN HASHCAT FOLDER .
MAKE PASSWORDS IN WORD.TXT  AND CONVERT THEM INTO HASHES AND SAVE IN HASH.TXT
RUN THE FOLLOWING COMMANDS IN CMD:
hashcat -m 0 -a 0 hash.txt word.txt

Hashcat -m 0 hash.txt –show


OUTPUT:

LAB SAFETY: Perform security testing only on systems, accounts, and networks you own or have explicit permission to test. Use isolated training targets and follow instructor directions.