John the Ripper 是一款常見的弱口令檢測（或者說是破解）的小工具蛋济。
一棍鳖、John the Ripper 的編譯過程
其編譯與安裝過程比較簡單：
- 在官網(wǎng)上下載源代碼：https://www.openwall.com/john/
- 解壓縮并進(jìn)行編譯：make clean linux-x86-64
# 注意，clean 后面需要跟上體系架構(gòu)參數(shù)瘫俊，如果沒有內(nèi)容鹊杖，會(huì)提示如下內(nèi)容
andy@localhost:~/SourceCode/John-1.8.0/src$ make
To build John the Ripper, type:
make clean SYSTEM
where SYSTEM can be one of the following:
linux-x86-64-avx Linux, x86-64 with AVX (2011+ Intel CPUs)
linux-x86-64-xop Linux, x86-64 with AVX and XOP (2011+ AMD CPUs)
linux-x86-64 Linux, x86-64 with SSE2 (most common)
linux-x86-avx Linux, x86 32-bit with AVX (2011+ Intel CPUs)
linux-x86-xop Linux, x86 32-bit with AVX and XOP (2011+ AMD CPUs)
linux-x86-sse2 Linux, x86 32-bit with SSE2 (most common, if 32-bit)
linux-x86-mmx Linux, x86 32-bit with MMX (for old computers)
linux-x86-any Linux, x86 32-bit (for truly ancient computers)
linux-alpha Linux, Alpha
linux-sparc Linux, SPARC 32-bit
linux-ppc32-altivec Linux, PowerPC w/AltiVec (best)
linux-ppc32 Linux, PowerPC 32-bit
linux-ppc64 Linux, PowerPC 64-bit
linux-ia64 Linux, IA-64
freebsd-x86-64 FreeBSD, x86-64 with SSE2 (best)
freebsd-x86-sse2 FreeBSD, x86 with SSE2 (best if 32-bit)
freebsd-x86-mmx FreeBSD, x86 with MMX
freebsd-x86-any FreeBSD, x86
freebsd-alpha FreeBSD, Alpha
openbsd-x86-64 OpenBSD, x86-64 with SSE2 (best)
openbsd-x86-sse2 OpenBSD, x86 with SSE2 (best if 32-bit)
openbsd-x86-mmx OpenBSD, x86 with MMX
openbsd-x86-any OpenBSD, x86
openbsd-alpha OpenBSD, Alpha
openbsd-sparc64 OpenBSD, SPARC 64-bit (best)
openbsd-sparc OpenBSD, SPARC 32-bit
openbsd-ppc32 OpenBSD, PowerPC 32-bit
openbsd-ppc64 OpenBSD, PowerPC 64-bit
openbsd-pa-risc OpenBSD, PA-RISC
openbsd-vax OpenBSD, VAX
netbsd-sparc64 NetBSD, SPARC 64-bit
netbsd-vax NetBSD, VAX
solaris-sparc64-cc Solaris, SPARC V9 64-bit, cc (best)
solaris-sparc64-gcc Solaris, SPARC V9 64-bit, gcc
solaris-sparcv9-cc Solaris, SPARC V9 32-bit, cc
solaris-sparcv8-cc Solaris, SPARC V8 32-bit, cc
solaris-sparc-gcc Solaris, SPARC 32-bit, gcc
solaris-x86-64-cc Solaris, x86-64 with SSE2, cc (best)
solaris-x86-64-gcc Solaris, x86-64 with SSE2, gcc
solaris-x86-sse2-cc Solaris 9 4/04+, x86 with SSE2, cc
solaris-x86-sse2-gcc Solaris 9 4/04+, x86 with SSE2, gcc
solaris-x86-mmx-cc Solaris, x86 with MMX, cc
solaris-x86-mmx-gcc Solaris, x86 with MMX, gcc
solaris-x86-any-cc Solaris, x86, cc
solaris-x86-any-gcc Solaris, x86, gcc
sco-x86-any-gcc SCO, x86, gcc
sco-x86-any-cc SCO, x86, cc
tru64-alpha Tru64 (Digital UNIX, OSF/1), Alpha
aix-ppc32 AIX, PowerPC 32-bit
macosx-x86-64 Mac OS X 10.5+, Xcode 3.0+, x86-64 with SSE2 (best)
macosx-x86-sse2 Mac OS X, x86 with SSE2
macosx-ppc32-altivec Mac OS X, PowerPC w/AltiVec (best)
macosx-ppc32 Mac OS X, PowerPC 32-bit
macosx-ppc64 Mac OS X 10.4+, PowerPC 64-bit
macosx-universal Mac OS X, Universal Binary (x86 + x86-64 + PPC)
hpux-pa-risc-gcc HP-UX, PA-RISC, gcc
hpux-pa-risc-cc HP-UX, PA-RISC, ANSI cc
irix-mips64-r10k IRIX, MIPS 64-bit (R10K) (best)
irix-mips64 IRIX, MIPS 64-bit
irix-mips32 IRIX, MIPS 32-bit
dos-djgpp-x86-mmx DOS, DJGPP, x86 with MMX
dos-djgpp-x86-any DOS, DJGPP, x86
win32-cygwin-x86-sse2 Win32, Cygwin, x86 with SSE2 (best)
win32-cygwin-x86-mmx Win32, Cygwin, x86 with MMX
win32-cygwin-x86-any Win32, Cygwin, x86
beos-x86-sse2 BeOS, x86 with SSE2 (best)
beos-x86-mmx BeOS, x86 with MMX
beos-x86-any BeOS, x86
generic Any other Unix-like system with gcc
- 編譯完成后，會(huì)在 “src” 同級的 “run” 目錄中生成名為 “john” 的程序扛芽，直接使用即可骂蓖，其實(shí)也不涉及什么安裝流程了。
二川尖、John the Ripper 的使用方法
1. 檢測（或者說破解）弱口令
1）Linux 的用戶口令保存在 “/etc/shadow” 文件中登下，可先將其拷貝到一個(gè)文本文檔中：
# shadow 加密保存 root 或其他用戶的口令
sudo cat /etc/shadow
root:$6$6VgjtRpu$DbbXO54tDOsqhEQD1rqrwrL83cd4fSUisNHvFu69VA5mYIKtE556LQzzbaSxGLQFh7u.smpe2meRjTPn5y0uJ1:17716:0:99999:7:::
andy:$6$DK4ye8lg$.DWNm6KZbt.0gbpwN/KoKUoC.2wONd.JQL/Dp8jGYOcUHAt37ecz24Zy5bfq3EUw8Ajt1aAuQT.hWEqxPr1Su1:17716:0:99999:7:::
#拷貝 shadow 文件
sudo cp /etc/shadow shadow.txt
2）執(zhí)行檢測或破解
#執(zhí)行檢測或破解
andy@localhost:~$ run/john shadow.txt
Loaded 2 password hashes with 2 different salts (crypt, generic crypt(3) [?/64])
Press 'q' or Ctrl-C to abort, almost any other key for status
123456 (andy)
123456 (root)
andy@localhost:~$ run/john --show shadow.txt
root:123456:17716:0:99999:7:::
andy:123456:17716:0:99999:7:::
2. 更新弱口令字典
1）John the Ripper 針對弱口令的檢測或破解，其實(shí)就是利用了弱口令字典叮喳。其默認(rèn)的字典保存在 “run” 目錄中被芳，文件名為 “password.lst”，下面截取了一小段馍悟，感受一下
123456
12345
password
password1
123456789
12345678
1234567890
abc123
computer
tigger
1234
qwerty
money
carmen
mickey
secret
summer
internet
a1b2c3
123
service
2）做一個(gè)實(shí)驗(yàn)畔濒，我把用戶的密碼強(qiáng)度提高，比如123456@china锣咒，這就不在弱口令字典中了
andy@localhost:~$ sudo passwd andy
[sudo] password for andy:
Enter new UNIX password:
Retype new UNIX password:
3）重新拷貝 “/etc/shadow” 文件侵状，然后進(jìn)行檢測或破解赞弥，你會(huì)發(fā)現(xiàn)經(jīng)過很長時(shí)間也破解不了
CPU狂轉(zhuǎn)，這就是暴力破解
4）將該密碼也作為弱口令添加到弱口令字典中趣兄，再進(jìn)行檢測或破解呢绽左？
編輯弱口令字典
重新執(zhí)行檢測或破解，這次很快就破解了艇潭。也就是說拼窥，隨著時(shí)間的延續(xù)發(fā)展，可以不斷的更新弱口令字典蹋凝，以保證口令的強(qiáng)度鲁纠。
andy@localhost:~$ run/john shadow.txt
Loaded 2 password hashes with 2 different salts (crypt, generic crypt(3) [?/64])
Remaining 1 password hash
Press 'q' or Ctrl-C to abort, almost any other key for status
123456@china (andy)
andy@localhost:~$ run/john --show shadow.txt
root:123456:17716:0:99999:7:::
andy:123456@china:17821:0:99999:7:::
2 password hashes cracked, 0 left
