I have a question about John the Ripper and it's incremental mode. As far as I know, the incremental mode is a brute-force mode, and it tries to get the password by systematic combining all possibilities for a password.

Depending on the password type it takes longer, that's clear. But let it be a md5 salted password hash. Is John automatically using the salt which is written in cleartext on /etc/shadow file to crack the password? or is it also guessing a valid salt?

  • 1
    I'm having trouble connecting your two paragraphs. Incremental mode and salting are independent of one another. Oct 23 '17 at 7:20

Most attacks on salted hashes assume that the salt directly accompanies the hash, usually directly in the hash format itself, or in a "hash:salt" format.

If you know the plaintext and you're trying to figure out the salt, you can use methods like the ones in my answer here.

If you know neither the plaintext nor the salt, that's trickier. MDXfind can generate short salts for you and also accept wordlists as plain text, so if it's a short static salt shared among many passwords, you can discover the salt.

But out of the box, most tools aren't going to try to guess both the plaintext and the salt simultaneously unless you do something to explicitly make that happen.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.