0

I am new to JTR and am currently trying to crack some passworts I generated.

Because I am new to JTR, I wanted to start by hashing a simple password like "Cat", write it in a file named pw.txt and then crack the password with John.

Here is what I did:

echo -n 'Cat22'|sha256sum>pw.txt

afterthat I edited the pw.txt file with vim to delete the - at the end of the hash.

Then I tried to crack it:

john --wordlist=rockyou.txt pw.txt

or with the Hash-Type:

john --wordlist=rockyou.txt --format=raw-sha256 pw.txt

The rockyou.txt file and password file are in the same directory, in which I am running the command.

Now the problem: If I want to crack my password, I am getting this message:

Using default input encoding: UTF-8
Loaded 1 password hash (Raw-SHA256 [SHA256 128/128 SSE2 4x])
Warning: poor OpenMP scalability for this hash type, consider --fork=6
Will run 6 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:01 DONE (2024-04-25 23:17) 0g/s 11383Kp/s 11383Kc/s 11383KC/s *ale123..*7¡Vamos!
Session completed.

john pw.txt takes forever, which is why I want to use a wordlist. Do you have any tips for me and know what I did wrong? Thank you very much :)

Improve this question
5
  • 1
    Is Cat22 in rockyou?
    – Gh0stFish
    Commented Apr 26 at 14:28
  • Sorry for the late response, Cat22 with a capital C is not in rockyou, however cat22 is in rockyou. Do you think this has something to do with the problem?
    – darquis
    Commented Apr 28 at 11:33
  • Then the next question would be whether you have a rule that capitalises the first letter of words from the wordlist - because if not then it's not going to crack it.
    – Gh0stFish
    Commented Apr 28 at 12:06
  • I managed to crack it! Sorry for asking again, but I do need to crack a random generated 8 letter password with upper and lowercase letters now. Do you think: john --incremental=Alpha --min-length=8 --max-length=8 hashed_passwords.txt would work for this? I hashed the passwords with bcrypt. I guess wordlists would not be effective in this case because random generated passworts are not included in most of them.
    – darquis
    Commented May 5 at 0:01
  • I think you need to reconsider your approach, because unless you have some very powerful hardware you're not going to be cracking 8 character random bcrypt hashes any time soon.
    – Gh0stFish
    Commented May 5 at 10:38

0

Reset to default

You must log in to answer this question.