3

I have a password file with 7 passwords, but JTR only could crack 4 and 3 that couldn't.

What it's the reason?

C:\tmp\john179j5\run>john --show shadow.txt
root:password:12923:0:99999:7:::
student1:password:12989:0:99999:7:::
user1:password:13122:0:99999:7:::
user3:dog:13122:0:99999:7:::

4 password hashes cracked, 3 left
5

Never expect to crack 100% of hashes.

To crack hashes, John the Ripper iteratively tries to input candidate passwords into the hash function and checks if there is a match. If it tries every word in the dictionary you provide it, or if it has exhausted the combinations you have set it to use without having cracked every hash, then naturally it will stop while there is still more remaining. All this means is that the remaining three passwords will need more time to crack, and that you may need to use a larger dictionary. This may mean a few more days, or the passwords may be so secure that it will never manage to crack them. This is to be expected.

1

John the Ripper is an open source password cracking tool. JTR's windows binaries by default support password cracking using wordlists and word-mangling first and then use the "incremental" mode which brute forces the hashes stored in the file if the wordlist method fails. However, JTR's pre-built versions support incremental mode up to 8 characters only. To brute force longer passwords, you need to build your own JTR using the source code on their official website.

In simple words, the reasons you are not able to crack passwords -

  • Passwords are not in the wordlist or any other combination of words in the wordlist.
  • Your incremental mode supports upto 8 characters only.

Cracking passwords longer than 8 characters would required you build your own JOHN and it takes a lot of time to crack passwords longer than 8 characters.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.