**Lab-3: Cracking password with John** 1. Once you connect to your VM using RDP or SSH, and run the ssudo apt-get purge john -y && sudo snap install john-the-ripper && sudo reboot command in you VM. 2. Your VM will be closed but you cna re-establish you session via ssh and RDp to access the VM. 3. Next, go ahead and unzip the folder (you can use the unzip command) and take a look at the files (using ls). You should have: * crackA.txt * crackB.txt * crackC.txt * crackChallenge.txt * lower.lst 4. Once you do that run the following command to get the wordlists from the web in the terminal wget https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt 5. You should have the following files in your unti3 folder. codepath@lab000001:~/unit3$ ls crackfiles.zip rockyou.txt cp_leak.txt 6. Run the following command: less -N ./rockyou.txt and you should see a big word list showing up. You can search for a word using & and look up its form such as &puppy. 7. Now, it seems that this word list is ok. Let's try to crack passwords 8. For crackA.txt,run the following command john --single crackA.txt and you should be able to crack the passwords. ![](https://hackmd.io/_uploads/BkGNKJBxp.png) 9. For crackB txt, run john --wordlist=lower.lst crackB.txt to crack Jim's password, john --wordlist=lower.lst crackB.txt --rules=l33t to crack Dwight's password, and john --wordlist=lower.lst crackB.txt --rules=shifttoggle to crack Pam's password. ![](https://hackmd.io/_uploads/H1TR5krx6.png) 10. For crackC.txt, we can run john --incremental=digits --min-length=4 --max-length=6 crackC.txt to crack pinball's passwords, john --mask=?d?u?l?l crackC.txt to crack pacman's passwords, and john --mask=?l?l?l?l?d! crackC.txt to crack frogger's password. ![](https://hackmd.io/_uploads/H1gl21rgT.png) 11. You can see your passwords in using ~~/snap/john-the-ripper/610/.john/john.pot command and use less to see the passwords you cracked.