Open-Source Security Tools
John the Ripper: Password Auditing Done Right
John the Ripper is password auditing's original workhorse: extract hashes, feed them in, and let CPU loops and wordlist rules find weak credentials at scale. Its professional role is the impact section of a report — proving that a password policy exists on paper and fails in practice, where a rockyou.txt run through John turns account story into account finding. It is steady, scriptable, and format-rich, and the price for that steadiness is single-threaded performance compared to GPU cracking.
Key points
- Workflow basics: unshadow /etc/passwd + /etc/shadow into one file, then john --wordlist=rockyou.txt hashfile for the standard first pass.
- Incremental (mask) mode gives non-dictionary coverage: john --incremental hashfile burns CPU on pure brute force and earns its hour only for hashes you care about.
- Format flags matter: --format=NT, sha512crypt, or the newer Jumbo formats; the wrong format guess wastes hours on the wrong engine.
- Rules are the professional lever: wordlists plus mangling rules (rules/best64-style sets) find the Password1! patterns that raw lists miss.
- Jumbo adds the modern practicalities: PDF, ZIP, bcrypt archives, and --show to list cracked passwords as a clean report line.
- This is CPU territory: JtR scales by cores and machine count; leave GPU-scale work to hashcat and pick per workload.
- Ethics here is the sharpest of the toolbox: you audit hashes you were authorized to audit — client-owned systems, lab machines, engagement-scope files, because cracked passwords are real credentials to real people's data.
- Delivery matters more than the crack: once you have the proof, the report shows impact (policy, reuse, rotation gaps) and never a spreadsheet of live passwords beyond what the client contractually asked to see.
Field note
John found six accounts sharing a season's-days pattern and earned our team the entire policy rewrite we'd been asking for. CPU realities taught me to state the wordlist and the hours in the report, not the guesswork.
Frequently asked questions
John or hashcat?
Both: John owns CPU work, formats, and quick jobs; hashcat owns GPU scale; a toolbox keeps both and picks by workload.
Why not rainbow tables?
They died with salts: modern password storage (bcrypt, scrypt, salted hashes) makes precomputed tables useless, which is why wordlists plus rules won.
How long should a password audit run?
Scoped: a bounded CPU run on client-selected hash sets, a few hours to a day, with the outliers named; endless runs burn budget without changing the finding.
What does Jumbo mean in the name?
The community Jumbo build carries extra formats, patch formats, and -- modes; for professional work it is the version you install, full stop.
How Kinetikatech helps with open-source security tools
Here's the deal: The testing toolbox professionals actually keep loaded: scanners, sniffers, crackers, and web proxies explained the way they are used on real engagements — commands, flags, outputs, and where each one sits in a methodology. Hand it to our Penetration Testing and Linux Server Security service and it's covered, assessed properly, implemented cleanly, monitored around the clock.