MN623 T2 2019: Report on Penetration Testing Tool Demonstration

This report provides a comprehensive overview of penetration testing tools, specifically focusing on John the Ripper and RainbowCrack. It begins with an introduction to password cracking tools and their application in assessing business system vulnerabilities, discussing methods like rainbow tables and brute force attacks. The report outlines the tools' functionalities, including how John the Ripper can crack encrypted codes and RainbowCrack utilizes time-memory trade-off methods. It demonstrates the use of these tools, compares their performance in terms of time and ease of use, and analyzes scenarios for their application. The report also covers password cracking countermeasures and penetration testing on a webserver. The conclusion highlights the pros and cons of each tool, emphasizing the importance of secure password policies. References are included to support the findings. The assignment evaluates the use of password cracking tools to identify security vulnerabilities and breaches in e-commerce platforms and Linux-based FTP webservers.

DEMONSTRATION OF
PENETRATION TESTING TOOLS

Contents
Introduction.............................................................................................................................................................2
Outline..................................................................................................................................................................... 2
Demonstration.........................................................................................................................................................2
Password crackers................................................................................................................................................2
Countermeasures.................................................................................................................................................2
Demonstration of use:..........................................................................................................................................3
Comparison..............................................................................................................................................................3
Time is taken to crack the password....................................................................................................................3
Ease of usage........................................................................................................................................................3
Analysis of the scenario...........................................................................................................................................3
Analysis.................................................................................................................................................................3
Penetration testing on the webserver..................................................................................................................3
Conclusion:...............................................................................................................................................................3
Reference:................................................................................................................................................................4
1

Introduction
This document discusses password cracking tools and their application. Among various tools available in the
market for vulnerability assessment of business systems, two of the prominent tools namely, John the Ripper
and RainbowCrack has been chosen to perform the assessment. The document discusses different methods of
cracking such as rainbow tables and brute force attack.
John the Ripper is a password cracker for Windows NT/95, UNIX and DOS. With the use of John the encrypted
codes that are stored on these Operating system databases can be cracker at a fast speed. There is feature in
this software through which it guesses password that have special character by placing the characters
automatically in a reasonable order in each guess [2]
On the other hand RainbowCrack is a hash cracker. It implements Philippe Oechslin's time-memory trade-off
method to crack hashes. The hashes are crack using rainbow tables. It is totally different from brute force
technique of hash cracking.
Outline
In today's era most of the companies are unable to effectively implement strong password policies and hence
they must implement the password cracker John the Ripper, as it is distributed at no cost and is backed up by
Openwall which is an open source community. This tool can be run across, Windows MAC as well as Linux and
other MS office suite products and messaging software. With the tool the user gets a wide range of wordlists to
test the passwords of their employees as well as documents to maintain strong password policies [3]. John the
Ripper provides the community with improved performance hash cracking which is based on CPU's Data
Encryption Standard algorithm [1]. John the ripper uses Brute force or dictionary attack techniques in order to
unveil the password.
In a brute force hash cracker all the reasonable plaintext are generated and the corresponding hashes are
computed immediately, and then hashes are compared with the one to be cracked. Plaintext can be found
corresponding to a match. Whereas a time-memory trade-off technique requires pre-computation. All the
hash/plaintext pairs in the given hash algorithm, plaintext, charset are computed and stored in the files namely
rainbow table. This stage is very time consuming, however, once the pre-computation done the hashes that are
stored within the table can cracked efficiently as compared to the brute force cracker [6].
The rainbowcrack uses pre-created rainbow tables to perform password cracking. The rainbow table has all the
possible hash of the characters that are used in the password.
Demonstration
Password crackers
For all the computer systems passwords are considered as first line of defense, and hence they are first target of
the attacker and/or intruder attempt to compromise and decode. Thus it is critical to maintain strong passwords
by each of the authorized users and to know that the system are not vulnerable to passwords that may be
stored on the network unprotected. There are variety of techniques that can be used to crack password such as
brute force attack, dictionary attack, spidering, rainbow tables etc. The most common technique among these
are brute force and rainbow table attacks
2

Countermeasures
To avoid the chances of passwords been cracked following counter measures can be used by organizations and
users:
1. Short and predicable passwords should be avoided.
2. Passwords that have predicable patterns such as 224488 should be avoided.
3. The passwords should always be stored in encrypted form in the databases. It is always a good practice to salt
the password hashes before storing.
4. Most of system have indicators on password strength, this and other strong policies should be adopted for
high password strength numbers [4].
Demonstration of use:
Comparison
Time is taken to crack the password
The method of rainbowcrack is usually much faster than john the ripper as the hashes are pre-computed which
saves a lot of time spend in computation particularly if the passwords are in billions. The drawback is obviously
the significant space taken up by rainbow table which is usually in 100s of gigabytes.
Ease of usage
To detect weak passwords in Linux John the Ripper can crack them easily by making thousands of attempts every
second. RainbowCrack is a fast and efficient method of password cracking because of use of quick comparison
from rainbow tables instead of using "brute force" to gain password hash [5]. RainbowCrack on the other hand
supports table of any hash algorithm and charset. However, salting algorithm can simply nullify rainbow tables.
Analysis of the scenario
Analysis
John the ripper can be a good option for assessing weakness in the e-commerce website. As the number of
employees and user’s accounts in the system of Mr. Gromer is not much they can opt for this tool . It can rapidly
assess the weak passwords in the server and the network anytime during and after development of their
website [5].
Penetration testing on the webserver
To perform password cracking using John the Ripper, firstly, on the targeted server that has account of users
(say), we use Pwdump to dump the hashes of the password on the server. The hash file then moved to separate
computer and then used John the Ripper program to crack hashes and get password for the account. Within this
program there is a dictionary list that is used for cracking the passwords. The Program executed “. /john -
wordfile:password.lst” which can at once broke the passwords.
To crack password using RainbowCrack first rainbow tables are generated. This tables can be either downloaded
from Project RainbowCrack that includes paid tables that are optimized for MD5, SHA1, LM, NTLM etc protocols.
The tool for generating the Rainbow tables comes with the RainbowCrack download. Then will move towards
sorting the rainbow tables, and then run the cracker. It will immediately match the hash value with the plaintext
in order to obtain the password.
3

Conclusion:
Both of the tools discussed in this document have some pros as well as limitations. In terms of computational
speed, rainbow attacks are considered superficial than brute force attacks, however pre-computation time and
size is an issue in the use of rainbowcrack tool. Thus using John the ripper can help the assessment of
vulnerability in the e-commerce website. Mr. Gromer should change the process of login to make the password
set by their employees and users much more secure [6].
Reference:
[1] Anonymous ""John the Ripper" Open Source Password Cracker Offers Increased Speed Through 17 Percent
Improvement in Gate Count for Data Encryption Standard (DES) Algorithm," Business Wire, 2011. Available:
https://search.proquest.com/docview/873179920?accountid=30552
[2] B. Middleton, "Using the hacker's toolbox," Security Management, vol. 43, (6), pp. 59-65, 1999. Available:
https://search.proquest.com/docview/231197926?accountid=30552
[3] D. Melber, "Authentication Protocols and Password Security," Internal Auditing, vol. 20, (1), pp. 38-42, 2005.
Available: https://search.proquest.com/docview/214391297?accountid=30552
[4] J. A. Chester, “Analysis of Password Cracking Methods & Applications”, 2015, Available:
https://pdfs.semanticscholar.org/8f62/7279286100d10a45e4625f56b6ff43231513.pdf
[5] M. Thurman, "Be Careful What You Ask For." Computerworld, vol. 41, (17), pp. 27, 2007. Available:
https://search.proquest.com/docview/216092829?accountid=30552
[6] W. Han et al, "Shadow Attacks Based on Password Reuses: A Quantitative Empirical Analysis," IEEE
Transactions on Dependable and Secure Computing, vol. 15, (2), pp. 309-320, 2018. Available:
http://dx.doi.org/10.1109/TDSC.2016.2568187
4