Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
john /etc/shadow

look like working, because john will use many-many CPU for it. But why is unshadowing needed? Why isn't it enough to use "john /etc/shadow"? Because of the salting? Can someone explain why is unshadowing needed?

UPDATE: the unshadowing looks like this:

unshadow /etc/passwd /etc/shadow > /tmp/unshadowed
john /tmp/unshadowed
share|improve this question
What's the difference between the two commands? – Lucas Kauffman Jul 19 '13 at 6:24
up vote 0 down vote accepted

John will also use the information from the GECOS fields in /etc/passwd as dictionary words used to crack the hash.

share|improve this answer
are you sure? :) – gasko peter Jul 24 '13 at 18:28

The unshadow utility combines the password hash stored in the /etc/shadow file with the contents of the /etc/passwd file. When the two files are combined, you can then crack users belonging to specific groups or skip users with expired credentials etc. For example, an expired file with have the shell=/etc/expired in /etc/passwd file, you can tell john to skip all those hashes which have a shell=/etc/expired option set:
john --shells=-/etc/expired <path of unshadow password file>

Note a minus sign infront of the shells parameter. If tell john to skip those hashes having the expired shell.

john --groups=admin,root <path of the unshadow password file>

The above command is going to crack only those accounts which are in the admin and root group. Hence when the two files are combined, you have a lot of flexibility which hashes you want to crack. But you can certainly use john just with the shadow file as well if you want to.

share|improve this answer
So it's only for this reason? isn't it needed for salting, or other purposes? – gasko peter Jul 19 '13 at 11:04
@gaskopeter salt of the password is stored in the /etc/shadow file with the hash. You don't need /etc/passwd file for the salt because /etc/passwd don't have any salt. – void_in Jul 19 '13 at 13:49
The weak point in most systems is the users, so you might have wordlists that are tailored to users in a particular role, or career, by using a groups filter you could do more targeted cracking attempts. – Rod MacPherson Jul 19 '13 at 16:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.