Writing Your Own Rules in John the Ripper

Introduction

John the Ripper (JtR) is one of the most popular and powerful tools for password cracking. It can be used for both simple and complex password-cracking tasks. It’s especially useful for testing large password lists or cracking password hashes. However, using just the default wordlists may not always be enough. To deal with stronger, more complex passwords that have been protected with advanced security measures, writing custom rules is a significant advantage. In this article, we will explore how you can write your own rules in John the Ripper, understand the logic behind these rules, and customize your password-cracking processes.

Learning Objectives

By the end of this article, readers will:

• Understand the structure of rules in John the Ripper.
• Grasp the basic logic behind writing custom password-cracking rules.
• Be able to write customized rules for different password-cracking scenarios.
• Learn key considerations when writing rules.

Understanding the Structure of Rules in John the Ripper

In John the Ripper, rules are written to manipulate the words used in the password-cracking process. These rules allow for more efficient password guesses by modifying words in various ways—such as adding characters to the beginning or end, reversing the word, or converting letters to uppercase or lowercase. The structure of rules in John the Ripper is highly flexible, allowing powerful manipulations with simple symbols. This enables you to make the most out of a default wordlist by applying various modifications.

For example:

• ^1 adds the number 1 to the beginning of a word.
• $9 adds the number 9 to the end of a word.
• u converts all letters in the word to uppercase.
• r reverses the word.

Each of these symbols can make simple password guesses much stronger and more complex. For instance, even a simple word written in lowercase can become a stronger guess by converting it to uppercase, adding numbers at the beginning or end, and applying other modifications.

Read: John the Ripper Usage Cheat Sheet: A Quick Guide

Basic Logic Behind Writing Rules

The basic logic behind writing rules is to manipulate given words in specific ways. In John the Ripper, these manipulations are applied using a rule set, and each rule is processed in sequence. By altering the structure of the words in a wordlist, more password guesses can be generated. For example, adding a number at the beginning of a word or appending a special character at the end can make the password-cracking process more efficient. Words manipulated with uppercase/lowercase letters, numbers, and symbols generate more complex password guesses.

When writing rules, it is important to consider the structure of the passwords you aim to guess. If the majority of the target passwords include numbers and letters, you should optimize your rules accordingly.

Step-by-Step Guide to Writing Your Own Rule

1. Edit the Rule File: Access John the Ripper’s john.conf file, and create a new rule set like [List.Rules:Custom]. This section will define your rule set, and you can add new rules here.
2. Create a Simple Rule: Let’s start with a basic rule that adds 1 to the beginning of a word, 9 to the end, and converts all letters to uppercase:

[List.Rules:Custom]
^1 $9 u

1. This rule:
   • ^1: Adds 1 to the beginning of the word.
   • $9: Adds 9 to the end of the word.
   • u: Converts all letters to uppercase.

3. Add Word Reversal: To reverse the word, use the r symbol. This symbol reverses the word from start to finish:

[List.Rules:Custom]
^1 $9 r u

This rule will first add 1 to the beginning of the word and 9 to the end, then reverse the word and convert it to uppercase. For example, the word “password” will become 9DROWSSAP1 with this rule.

4. Add Letter Manipulation: This rule will make the second letter uppercase and append @! to the end. It also ensures all letters remain lowercase. This combines letter manipulation with character addition in the password-guessing process:

[List.Rules:Custom]
p1u $@!

• p1u: Makes the second letter uppercase.
• $@!: Adds @! to the end.
• In addition to letter manipulation, this rule appends two special characters to create password variations.

Example: The word “secure” will become sEcur@! with this rule.

Mastering Python for Ethical Hacking: A Comprehensive Guide to Building 50 Hacking Tools

Let’s embark on this journey together, where you will learn to use Python not just as a programming language, but as a powerful weapon in the fight against cyber threats

-5% $25 on buymeacoffee

5. Add a Random Number and Uppercase Letter to the End: This rule appends a random number (0-9) and an uppercase letter (A-Z) to the end of the word. This is an effective strategy for generating additional variations in the password-cracking process

[List.Rules:Custom]
$[0-9] $[A-Z]

• $[0-9]: Adds a random number (0-9) to the end of the word.
• $[A-Z]: Adds a random uppercase letter (A-Z) to the end of the word.

Example: The word “secure” will become secure3Q or secure7M with various combinations.

6. Multiple Manipulations and Combinations: This complex rule adds both a number and a character to the beginning, modifies the middle letters, and appends a random uppercase letter and number to the end. Such complex rules generate a wide range of variations:

Read: Wordlist Creation Tool With Python: A Tool for Cybersecurity

[List.Rules:Complex]
^1^@ p2l r $[A-Z] $[0-9]

• ^1^@: Adds 1 and @ to the beginning of the word.
• p2l: Makes the second letter lowercase.
• r: Reverses the word.
• $[A-Z]: Adds a random uppercase letter to the end.
• $[0-9]: Adds a random number to the end.

Example: If the word is “example,” the password could result in something like 9Lpmxe@1.

With this rule, the password-cracking process will test many different variations, but be cautious of the computational cost and time required.

7. Run the Rule: To use the custom rule set in John the Ripper, run the following command:

$ john --wordlist=kelimeler.txt --rules=Custom --format=raw-md5 hash.txt

This command will apply your custom rule set to the words in kelimeler.txt, manipulating them according to the rules and trying to crack the passwords in the hash.txt file.

Key Considerations When Writing Rules

There are a few important factors to keep in mind when writing rules. These considerations will help make your password-cracking process more efficient and prevent undesired outcomes:

• Avoid Too Many Rules: Complex rules can extend the time required for password cracking and reduce performance. Each rule creates new combinations, meaning more guesses to process. Therefore, writing focused and targeted rules instead of overly complex ones can lead to better results.
• Write Rules Based on the Password Structure: Tailoring your rules to the structure of the passwords you want to crack will make the guessing process more effective. For example, if the target passwords include uppercase letters and numbers, it’s logical to write rules focusing on uppercase letters and numbers. Writing rules that manipulate lowercase letters or symbols might waste time if the passwords don’t include those characters.
• Test Your John Rules: Testing your rules on a small dataset first ensures they work as expected. Testing before using the rules on large datasets or password hashes can help you catch potential issues early.
• Be Aware of Performance Issues: Adding too many rules can lead to performance problems. The password-cracking process might take longer, and system resources could be strained. To optimize performance, avoid unnecessary rules and focus on efficient combinations.

Conclusion

Writing custom rules in John the Ripper can greatly enhance the effectiveness of the password-cracking process. By creating rules tailored to the structure of the passwords you are targeting, you can gain a significant advantage in your password-cracking tasks. With the steps and techniques covered in this article, you can now start writing your own powerful password-cracking rules. By creating rules that suit your specific needs and goals, you can speed up the cracking process and handle more complex passwords. Remember, password cracking should always be done ethically and for educational or security testing purposes only.

You May Be Interested In:

• John the Ripper Usage Cheat Sheet: A Quick Guide
• Social Media Security: Threats and Protection Methods
• PrivacyNet: Anonymization Tool to Safeguard Your Privacy
• Wordlist Creation Tool With Python: A Tool for Cybersecurity
• Evaluating Password Strength with Python: A Practical Guide