John the Ripper 是一款常见的弱口令检测（或者说是破解）的小工具。
一、John the Ripper 的编译过程
其编译与安装过程比较简单：
- 在官网上下载源代码：https://www.openwall.com/john/
- 解压缩并进行编译：make clean linux-x86-64
# 注意，clean 后面需要跟上体系架构参数，如果没有内容，会提示如下内容
andy@localhost:~/SourceCode/John-1.8.0/src$ make
To build John the Ripper, type:
make clean SYSTEM
where SYSTEM can be one of the following:
linux-x86-64-avx Linux, x86-64 with AVX (2011+ Intel CPUs)
linux-x86-64-xop Linux, x86-64 with AVX and XOP (2011+ AMD CPUs)
linux-x86-64 Linux, x86-64 with SSE2 (most common)
linux-x86-avx Linux, x86 32-bit with AVX (2011+ Intel CPUs)
linux-x86-xop Linux, x86 32-bit with AVX and XOP (2011+ AMD CPUs)
linux-x86-sse2 Linux, x86 32-bit with SSE2 (most common, if 32-bit)
linux-x86-mmx Linux, x86 32-bit with MMX (for old computers)
linux-x86-any Linux, x86 32-bit (for truly ancient computers)
linux-alpha Linux, Alpha
linux-sparc Linux, SPARC 32-bit
linux-ppc32-altivec Linux, PowerPC w/AltiVec (best)
linux-ppc32 Linux, PowerPC 32-bit
linux-ppc64 Linux, PowerPC 64-bit
linux-ia64 Linux, IA-64
freebsd-x86-64 FreeBSD, x86-64 with SSE2 (best)
freebsd-x86-sse2 FreeBSD, x86 with SSE2 (best if 32-bit)
freebsd-x86-mmx FreeBSD, x86 with MMX
freebsd-x86-any FreeBSD, x86
freebsd-alpha FreeBSD, Alpha
openbsd-x86-64 OpenBSD, x86-64 with SSE2 (best)
openbsd-x86-sse2 OpenBSD, x86 with SSE2 (best if 32-bit)
openbsd-x86-mmx OpenBSD, x86 with MMX
openbsd-x86-any OpenBSD, x86
openbsd-alpha OpenBSD, Alpha
openbsd-sparc64 OpenBSD, SPARC 64-bit (best)
openbsd-sparc OpenBSD, SPARC 32-bit
openbsd-ppc32 OpenBSD, PowerPC 32-bit
openbsd-ppc64 OpenBSD, PowerPC 64-bit
openbsd-pa-risc OpenBSD, PA-RISC
openbsd-vax OpenBSD, VAX
netbsd-sparc64 NetBSD, SPARC 64-bit
netbsd-vax NetBSD, VAX
solaris-sparc64-cc Solaris, SPARC V9 64-bit, cc (best)
solaris-sparc64-gcc Solaris, SPARC V9 64-bit, gcc
solaris-sparcv9-cc Solaris, SPARC V9 32-bit, cc
solaris-sparcv8-cc Solaris, SPARC V8 32-bit, cc
solaris-sparc-gcc Solaris, SPARC 32-bit, gcc
solaris-x86-64-cc Solaris, x86-64 with SSE2, cc (best)
solaris-x86-64-gcc Solaris, x86-64 with SSE2, gcc
solaris-x86-sse2-cc Solaris 9 4/04+, x86 with SSE2, cc
solaris-x86-sse2-gcc Solaris 9 4/04+, x86 with SSE2, gcc
solaris-x86-mmx-cc Solaris, x86 with MMX, cc
solaris-x86-mmx-gcc Solaris, x86 with MMX, gcc
solaris-x86-any-cc Solaris, x86, cc
solaris-x86-any-gcc Solaris, x86, gcc
sco-x86-any-gcc SCO, x86, gcc
sco-x86-any-cc SCO, x86, cc
tru64-alpha Tru64 (Digital UNIX, OSF/1), Alpha
aix-ppc32 AIX, PowerPC 32-bit
macosx-x86-64 Mac OS X 10.5+, Xcode 3.0+, x86-64 with SSE2 (best)
macosx-x86-sse2 Mac OS X, x86 with SSE2
macosx-ppc32-altivec Mac OS X, PowerPC w/AltiVec (best)
macosx-ppc32 Mac OS X, PowerPC 32-bit
macosx-ppc64 Mac OS X 10.4+, PowerPC 64-bit
macosx-universal Mac OS X, Universal Binary (x86 + x86-64 + PPC)
hpux-pa-risc-gcc HP-UX, PA-RISC, gcc
hpux-pa-risc-cc HP-UX, PA-RISC, ANSI cc
irix-mips64-r10k IRIX, MIPS 64-bit (R10K) (best)
irix-mips64 IRIX, MIPS 64-bit
irix-mips32 IRIX, MIPS 32-bit
dos-djgpp-x86-mmx DOS, DJGPP, x86 with MMX
dos-djgpp-x86-any DOS, DJGPP, x86
win32-cygwin-x86-sse2 Win32, Cygwin, x86 with SSE2 (best)
win32-cygwin-x86-mmx Win32, Cygwin, x86 with MMX
win32-cygwin-x86-any Win32, Cygwin, x86
beos-x86-sse2 BeOS, x86 with SSE2 (best)
beos-x86-mmx BeOS, x86 with MMX
beos-x86-any BeOS, x86
generic Any other Unix-like system with gcc
- 编译完成后，会在 “src” 同级的 “run” 目录中生成名为 “john” 的程序，直接使用即可，其实也不涉及什么安装流程了。
二、John the Ripper 的使用方法
1. 检测（或者说破解）弱口令
1）Linux 的用户口令保存在 “/etc/shadow” 文件中，可先将其拷贝到一个文本文档中：
# shadow 加密保存 root 或其他用户的口令
sudo cat /etc/shadow
root:$6$6VgjtRpu$DbbXO54tDOsqhEQD1rqrwrL83cd4fSUisNHvFu69VA5mYIKtE556LQzzbaSxGLQFh7u.smpe2meRjTPn5y0uJ1:17716:0:99999:7:::
andy:$6$DK4ye8lg$.DWNm6KZbt.0gbpwN/KoKUoC.2wONd.JQL/Dp8jGYOcUHAt37ecz24Zy5bfq3EUw8Ajt1aAuQT.hWEqxPr1Su1:17716:0:99999:7:::
#拷贝 shadow 文件
sudo cp /etc/shadow shadow.txt
2）执行检测或破解
#执行检测或破解
andy@localhost:~$ run/john shadow.txt
Loaded 2 password hashes with 2 different salts (crypt, generic crypt(3) [?/64])
Press 'q' or Ctrl-C to abort, almost any other key for status
123456 (andy)
123456 (root)
andy@localhost:~$ run/john --show shadow.txt
root:123456:17716:0:99999:7:::
andy:123456:17716:0:99999:7:::
2. 更新弱口令字典
1）John the Ripper 针对弱口令的检测或破解，其实就是利用了弱口令字典。其默认的字典保存在 “run” 目录中，文件名为 “password.lst”，下面截取了一小段，感受一下
123456
12345
password
password1
123456789
12345678
1234567890
abc123
computer
tigger
1234
qwerty
money
carmen
mickey
secret
summer
internet
a1b2c3
123
service
2）做一个实验，我把用户的密码强度提高，比如123456@china，这就不在弱口令字典中了
andy@localhost:~$ sudo passwd andy
[sudo] password for andy:
Enter new UNIX password:
Retype new UNIX password:
3）重新拷贝 “/etc/shadow” 文件，然后进行检测或破解，你会发现经过很长时间也破解不了
CPU狂转，这就是暴力破解
4）将该密码也作为弱口令添加到弱口令字典中，再进行检测或破解呢？
编辑弱口令字典
重新执行检测或破解，这次很快就破解了。也就是说，随着时间的延续发展，可以不断的更新弱口令字典，以保证口令的强度。
andy@localhost:~$ run/john shadow.txt
Loaded 2 password hashes with 2 different salts (crypt, generic crypt(3) [?/64])
Remaining 1 password hash
Press 'q' or Ctrl-C to abort, almost any other key for status
123456@china (andy)
andy@localhost:~$ run/john --show shadow.txt
root:123456:17716:0:99999:7:::
andy:123456@china:17821:0:99999:7:::
2 password hashes cracked, 0 left
