Password Testing And Breaking Programs

Slide 1
• John the Ripper is a free password cracking software tool. It is one of the
most popular password testing and breaking programs as it combines a
number of password crackers into one package.
John the ripper is a free password cracking tool mostly used in linux. It is used by
penetration testers for password breaking.
It has wide range of features like identifying the hash type and breaking it.
• RainbowCrack is a general propose implementation of Philippe Oechslin’s
faster time-memory trade-off technique. It crack hashes with rainbow
tables.
Rainbow crack is a good tool which breaks the hashes based on the input file.
Slide 2
• Initial stage information gathering is performed using nmap tool.
• Information gathering is performed on the given web server for checking
the open ports on the server using nmap.
• Then the services running on the ports with version is identified using the
same tool.
• Then vulnerability’s are identified in second stage.
• We used google for identifying the type of vulnerabilities available on the
services.
• We found many vulnerabilities on the services hosted b the server.
• We felt attacking ftp server will bring us more result with stable
connection.
• Then exploitation is undergone in third stage.
• We have used Metasploit framework for exploiting the ftp service hosted
by the server.
• Finally password breaking was performed using both the tools
Slide 3
 Recently john the ripper is upgraded in such a way that it performs attack
using GPU- graphical process unit  graphic cards.
 Rainbow attack doesn’t use the GPU.
 So this attack performed by john the ripper is much faster as GPU
processing speed is much faster than the CPU.
 Rainbow crack is also fast as it checks the hashes resent in the loaded
file.
 John the ripper automatically identifies the hash type. So, there is no use
of any other tools for identifying the hash value.
 We need to specify the hash type for this Rainbow crack. It can not
identify the hash value by its own.
 We don’t load any hashes for checking in John the ripper tool.