Installing John the Ripper Version 1.7.3.4 Tutorial

By -
I just upgraded to the newest version of John the Ripper so I decided to make a tutorial out of my experience, (with screen-shots), since it was a fairly time consuming ordeal. It's mostly focused on installing John the Ripper on a Mac OSX Snow Leopard, but you should be able to use most of it when installing it to various flavors of Linux as well. Besides going over the base install, I also tried to cover:
  • Which patches to install, where to find them, and how to apply them
  • Picking the right build options
  • Modifying the Makefile so it actually will install on Snow Leopard
  • Modifying the code so you can use incremental attacks against passwords longer than eight characters long
You can find it on my tools page, or by clicking on this link.

Comments

S. Hamid Kashfi said…
Interesting researches on passwords statistics. BTW just in case you've missed MPI, I've previously blogged about how to get the most out og JtR:

http://hkashfi.blogspot.com/2008/12/how-to-make-johntr-use-all-of-your-cpu.html

It may speed some of your works :)
November 17, 2009 at 12:01 AM
Max Thrun said…
+1 Kashfi

Have you tried the MPI patch on any of your sessions? I would be itneresting to see some graphs with and without it running with markov. great tutorial though
November 17, 2009 at 7:08 PM
Matt Weir said…
Hey, thanks for the comments, (and thanks for the link Hamid). I know I'm going to loose geek points, but I don't use the MPI patch since it doesn't really fit into my cracking setup, (aka I unfortunately don't have any eight core servers, or tons of machines on the same local network to distribute work between). Also, the MPI patch only handles unmodified incremental attacks, and it has "issues" properly distributing the workload.

I asked about it on the official John the Ripper forums and one of the main JtR Developers, Solar Designer, responded:

"It's a patch I'm trying to slowly let die, unless anyone has more time to make it properly split work"

That being said, I might try to install it this weekend to 1.7.3.4, (the last supported version it works on is 1.7.3.1), and see what happens. Regardless, I'll report back here with what I find.
November 19, 2009 at 4:02 PM
Matt Weir said…
Edit, I meant to say RB, (the creator of the MPI patch), was the one who posted that.
November 19, 2009 at 10:07 PM
S. Hamid Kashfi said…
Matt, thanks for your response on topic.

Will you please inform me if you've ported MPI patch to 1.7.3.4 ?

While you're right about MPI patch situation I still find it VERY useful, considering running it on my Intel i7 cpu. It make my cracking speed about 8 times faster so even if it`s buggy it worth the speed.

But I've always wondered why John is not supporting multi-core natively? Having multi-core cpu is ineed not common betwen normal cpu users, but it`s very common between hardcore John (and other password audit tools) users :)
November 20, 2009 at 2:49 PM
Matt Weir said…
Well I tried to install the MPI patch to JtR 1.7.3.4, but it failed. Apparently a couple of lines were changed in bench.c, so hopefully it won't be too hard of a fix.

As to your other question Hamid, it probably deserves a full post for the answer. The short answer is that John the Ripper wasn't developed to work in a multi-cpu environment. Therefore, the developers used a lot of tricks to make it run very fast on a single processor. Unfortunately, because of that, you would pretty much have to rewrite the entire core of John the Ripper to make it multi-threaded. The MPI patch worked because MPI is mostly a compile time optimization.
November 22, 2009 at 9:48 PM
Unknown said…
hi,
i'm a student and trying to learn more about terminal.
When i tried to do: cd john-1.7.6-jumbo-9-macosx-universal-1.zip
the terminal replies back no such file or directory found.
I'm confused because i already finished downloading and unzipping it.
pls help. i'm stock :(
December 28, 2010 at 11:28 AM
Post a Comment

Popular posts from this blog

Tool Deep Dive: PRINCE

By -
Image
Tool Name: PRINCE (PRobability INfinite Chained Elements) Version Reviewed: 0.12 Author: Jens Steube, (Atom from Hashcat) OS Supported: Linux, Mac, and Windows Password Crackers Supported:  It is a command line tool so it will work with any cracker that accepts input from stdin Blog Change History: 1/4/2015: Fixed some terminology after talking to Atom 1/4/2015: Removed a part in the Algorithm Design section that talked about a bug that has since been fixed in version 0.13 1/4/2015: Added an additional test with PRINCE and JtR Incremental after a dictionary attack 1/4/2015: Added a section for using PRINCE with oclHashcat Brief Description:   PRINCE is a password guess generator and can be thought of as an advanced Combinator attack . Rather than taking as input two different dictionaries and then outputting all the possible two word combinations though, PRINCE only has one input dictionary and builds "chains" of combined words. These chains can have 1 to N wo...
Read more

The RockYou 32 Million Password List Top 100

By -
But first, a quick responses to one of the previous comments, (since it really did merit a front-page post). Tfcx posted: The initial vulnerability was posted 29th November on a hacking forum called darkc0de here: http://forum.darkc0de.com/index.php?action=vthread&forum=11&topic=13082 Thanks, as that really helps narrow down the timeframe, (and reading that post and related posts was interesting if a bit depressing). The hack itself appears pretty straightforward once you see it, (like most things once the solution is presented to you it's easy, but finding it in the first place is hard). I'm still interested in the hacker Igigi, and have been tossing about all sorts of theories; but I'll refrain from posting them here since they are all pure WAGs right now. Now on to the main topic: Per Thorsheim wrote: I would like to see a comparison of Twitters 370 banned passwords against the top 370 or so passwords stolen from rockyou (http://www.techcrunch.com/2009/12/27/twi...
Read more

Cracking the MySpace List - First Impressions

By -
Image
Alt Title: An Embarrassment of Riches Backstory: Sometime around 2008, a hacker or disgruntled employee managed to break into MySpace and steal all the usernames, e-mails, and passwords from the social networking site. This included information covering more than 360 million accounts. Who knows what else they stole or did, but for the purposes of this post I'll be focusing only on the account info. For excellent coverage of why the dataset appears to be from 2008 let me refer you to the always superb Troy Hunt's blog post on the subject . Side note, most of my information about this leak also comes from Troy's coverage. This dataset has been floating around the underground crime markets since then, but didn't gain widespread notoriety until May 2016 when an advertisement offering it for sale was posted to the "Real Deal" dark market website. Then on July 1st, 2016, another researcher managed to obtain a copy and then posted a public torrent of then entir...
Read more