I have a salted MD5 hash and I also know the password. How can I recover the salt using tools like John The Ripper (I have JTR jumbo installed)?
With known plaintext, and assuming salting that uses simple string concatenation, some password-cracking suites like hashcat or MDXfind will let you bruteforce the salt. This will only be practical for simple salts (short enough to bruteforce, or if the character set of the salt is known well enough to keep the keyspace small).
For hashcat, the (perhaps non-intuitive) trick is to pretend that the salt is the password, and the password is the salt. This works when the salting is performed as a simple concatenation.
In this example, the known plaintext password is "password" and the unknown salt is "GR7". We'll be using hashcat's algorithm mode 20 (md5($salt.$pass)).
Here's the salted hash:
$ echo -n 'passwordGR7' | md5sum a598e9df477f07dadee6b6bee9ac1daa -
... and here's the target hash and "salt" (in the expected hash:salt format), but the "salt" is actually our known plaintext password:
$ cat hash.list a598e9df477f07dadee6b6bee9ac1daa:password
We then use a '?a?a?a' mask (all three-character printable strings) as potential "passwords" (really the salt):
$ hashcat --quiet -m 20 -a 3 hash.list ?a?a?a a598e9df477f07dadee6b6bee9ac1daa:password:GR7
To handle salts of different lengths or formats, simply adjust the mask or attack type. If the length of the salt isn't known, use
--increment to try all lengths up to the length of the supplied mask.
If the salt is prepended instead of appended, hashcat mode 10 (md5($pass.salt)) can be used instead (again, remembering that the "pass" in this context is actually the salt, using the same method as above).
I haven't explicitly done this with John the Ripper, but since John supports md5($p.$s) and md5($s.$p) using dynamic formats, I believe that the same technique can be used with John. But these dynamic formats are only on CPU at this writing, so if you have GPUs available, I'd recommend taking a look at hashcat instead.