Dictionary · Ethical Hacking Tools
John the Ripper
Password auditing · Intermediate
A CPU-oriented tool for auditing password hashes you are authorized to test offline. It checks whether stored passwords are weak enough to guess.
It does not log in to a live service. It works on a hash file from a system you administer or are hired to audit, and it shows which passwords are too easy.
Example: An audit of a lab's password hashes reports that one account used a common password. The fix is a new password and better policy, not reuse of the guess.
Git in the Zone explains security tools and attack terminology so you can recognize them and defend against them. Practice only on systems you own or have written permission to test. Nothing on this site runs a command or an exploit.
What it is for
Test whether authorized password hashes can be guessed on a CPU.
Authorized use: Audit only hashes from systems you own or are contracted to test. Git in the Zone does not provide guessing commands or wordlists.
Operating systems: Linux, macOS, and Windows.
Language you will see
- hash
- wordlist
- offline audit
How to read the options
- Offline audit: The test uses a stored hash, not repeated login attempts against a live service.
- Hash type: The stored format must be identified correctly or the audit is meaningless.
Common misconception
- A successful audit guess is a finding about password quality. It is not a credential to keep using.