Password Security Audit with John the Ripper

Crack password hashes and ZIP files using John the Ripper on WSL.

Introduction

30 Second Summary

Every online account you have is protected by a password. But how strong is that protection really? Security professionals test this by trying to crack passwords themselves, exposing weaknesses before attackers can exploit them.

In this project, you will build a password security audit lab using John the Ripper on WSL. You will generate password hashes, crack them using different attack modes, and document your findings in a professional GitHub repository.

What You'll Build

A self-contained password security audit lab that generates sample password hashes, cracks them with multiple attack strategies, and produces a documented report of your methodology and findings.

By the end of this project, you'll have:

  • A compiled John the Ripper Jumbo installation in WSL with verified cracking capability.
  • Cracked multiple password hashes using wordlist attacks, mask attacks, and rule-based cracking.
  • Extracted and cracked a password-protected ZIP file using hash extraction tools.
  • A professional GitHub repository documenting your full audit process, commands, and findings.
  • Secret Mission: Write custom wordlist rules and crack a hash that resists the default rockyou.txt attack.

Are there any prerequisites?

You need WSL installed with Ubuntu, Git installed inside WSL, and a GitHub account. If you do not have WSL set up yet, follow Microsoft's official WSL installation guide before starting this project.

Install John the Ripper Jumbo from Source

To crack passwords in this project, you need a powerful tool that understands hundreds of hash formats. John the Ripper is the industry-standard password cracking tool used by penetration testers and security professionals worldwide.

The version available through Ubuntu's package manager is a stripped-down build with limited format support. You'll build the Jumbo version from source, which supports 400+ hash formats and includes utilities like zip2john that you'll need later.

In this step, get ready to:
  • Install the build dependencies required to compile John the Ripper.
  • Clone and compile the Jumbo version from the official repository.
  • Verify the build works and set up a convenient shell alias.

Why build from source instead of apt install?

The john package in Ubuntu's default repositories is the minimal core version. It supports only a handful of hash formats and does not include helper tools like zip2john for extracting hashes from files.

The Jumbo build from the bleeding-jumbo branch supports 400+ formats, ships with extraction utilities, and is actively maintained. Building from source ensures you get the full toolkit.

Install build dependencies in WSL

Before you can compile John the Ripper, your WSL Ubuntu environment needs development libraries and a C compiler.

  • In your WSL terminal, update your package lists by running this command:
sudo apt-get update
  • Install the required build dependencies by running this command:
sudo apt-get -y install git build-essential libssl-dev zlib1g-dev pkg-config libgmp-dev libpcap-dev libbz2-dev

What do these packages do?

  • build-essential provides the C compiler (gcc) and make tool needed to compile source code.
  • libssl-dev and zlib1g-dev provide cryptographic and compression libraries that John uses internally.
  • The remaining packages add support for additional hash formats and network captures.
  • You should see a list of packages being installed with no error messages at the end.

Seeing permission denied?

  • Make sure you included sudo at the start of both commands. Without it, apt-get cannot install system packages.
  • If you see a network error, check your internet connection and run the command again.

Help me troubleshoot my apt-get install failure in WSL

Clone and build John the Ripper Jumbo

With the dependencies in place, you can now download the source code and compile it. The build process takes a few minutes depending on your machine's speed.

  • Create a source directory and clone the John the Ripper repository by running these commands:
mkdir -p ~/src
cd ~/src
git clone https://github.com/openwall/john -b bleeding-jumbo john

What does this command do?

  • mkdir -p ~/src creates a src folder in your home directory for storing source code. The -p flag means it won't error if the folder already exists.
  • git clone downloads the full repository. The -b bleeding-jumbo flag targets the actively maintained Jumbo branch with the latest format support.
  • You should see Git downloading objects and checking out files. This may take a minute or two depending on your connection speed.

Clone failing or timing out?

  • If you see a connection error, check that your WSL instance has internet access by running ping google.com.
  • If the ~/src/john folder already exists from a previous attempt, remove it first with rm -rf ~/src/john and try again.

Help me fix my git clone error in WSL

  • Compile John the Ripper by running these commands:
cd ~/src/john/src
./configure && make -s clean && make -sj4

What does the build command do?

  • ./configure checks your system for the available libraries and generates the correct build settings.
  • make -s clean removes any leftover files from a previous build attempt.
  • make -sj4 compiles the source code using 4 parallel jobs to speed things up. The -s flag silences non-essential output.
  • The build takes 3-5 minutes. When it finishes, you should return to a normal command prompt with no errors.
  • Confirm the executables were created by running:
ls ~/src/john/run/john
  • You should see the path ~/src/john/run/john printed with no "No such file" error.

Build failed with errors?

  • If ./configure reports missing libraries, go back and re-run the apt-get install command from the previous substep. Make sure every package installed successfully.
  • Make sure you are in the ~/src/john/src directory (not ~/src/john) when running the build commands.

Help me fix my John the Ripper build error

Verify the installation and set up an alias

The compiled binary lives in ~/src/john/run/, which is not in your system's PATH. You'll run a quick self-test to confirm the build works, then create a shell alias so you can type john from anywhere.

  • Run the self-test to verify every hash format works correctly:
cd ~/src/john/run
./john --test=0

What does --test=0 do?

The --test=0 flag runs a quick self-test of all compiled hash formats without performing a full benchmark. It confirms each format passes its internal checks. You should see lines like "Testing: DES... PASS" followed by a summary confirming all formats passed.

  • You should see multiple "PASS" lines scrolling by, ending with a message like "All N formats passed self-tests!" where N is the number of formats tested.

Seeing FAILED on a format?

  • A single failed format on an uncommon algorithm (like an OpenCL format without GPU support) is usually harmless for this project.
  • If you see many failures, delete the ~/src/john folder and repeat the clone and build steps from scratch.

Help me troubleshoot my John the Ripper self-test failures

  • Set up a shell alias so you can run john from any directory:
echo 'alias john="~/src/john/run/john"' >> ~/.bashrc && source ~/.bashrc

What does this command do?

  • echo '...' >> ~/.bashrc appends the alias definition to your shell configuration file so it persists across terminal sessions.
  • source ~/.bashrc reloads the configuration file immediately so the alias takes effect right now.
  • Verify the alias works by running:
john --test=0
  • You should see the same self-test output as before. This confirms the john alias is working from any directory.

Command not found after setting the alias?

  • Make sure you ran source ~/.bashrc after adding the alias. Without sourcing, the current terminal session does not know about the new alias.
  • Double check the alias was saved by running cat ~/.bashrc | grep john. You should see the alias line printed.

Help me fix my john alias not working in WSL

✔️ Awesome, I've got everything!

Great. Make sure you can run john --test=0 from any directory and see all formats pass.

ⓧ I'd like to double check the full setup

Here is what your ~/.bashrc should contain (at the end of the file):

alias john="~/src/john/run/john"

And running ls ~/src/john/run/john should show the file exists. Running john --test=0 from any directory should produce self-test PASS results.

Your John the Ripper Jumbo installation is ready. Next up, you'll generate sample password hashes to put it to work.

Generate Sample Password Hashes

John the Ripper needs something to crack. In the real world, password auditors work with hash files extracted from databases or system files.

In this step, you will generate your own sample hashes using openssl. You will create hashes in two different formats (MD5-crypt and SHA-512-crypt) and download a massive wordlist that John will use to guess the original passwords.

In this step, get ready to:
  • Generate MD5-crypt and SHA-512-crypt password hashes with openssl.
  • Format hash files with usernames for John the Ripper to read.
  • Download the rockyou.txt wordlist for cracking.
Create a project directory and generate MD5-crypt hashes

Password hashing algorithms turn plaintext passwords into fixed-length strings. The $1$ prefix identifies an MD5-crypt hash, and John the Ripper auto-detects this format.

  • Create your project directory and move into it by running these commands:
mkdir -p ~/password-audit
cd ~/password-audit

What does this command do?

The -p flag creates the directory only if it does not already exist. This prevents an error if you run the command twice.

  • Confirm the directory exists by running:
ls ~/password-audit

You should see an empty directory listing (no output is fine since it is empty).

  • Generate three MD5-crypt password hashes and save them to hashes.txt by running these commands:
# Generate MD5-crypt ($1$) hashes with known weak passwords
echo "user1:$(openssl passwd -1 -salt testsalt password123)" > hashes.txt
echo "user2:$(openssl passwd -1 -salt saltydog letmein)" >> hashes.txt
echo "user3:$(openssl passwd -1 -salt peppers dragon)" >> hashes.txt

What does this code do?

Each line uses openssl passwd -1 to generate an MD5-crypt hash. The -1 flag selects the MD5-based BSD password algorithm, producing hashes that start with $1$.

The -salt flag specifies a custom salt value mixed into the hash. The > operator creates the file, while >> appends to it. Prepending usernames (like user1:) matches the format John the Ripper expects.

  • Verify your hash file looks correct by running:
cat hashes.txt

You should see 3 lines, each starting with a username followed by a $1$ hash. For example, the first line looks like user1:$1$testsalt$ followed by a string of characters.

Seeing 'command not found' for openssl?

OpenSSL comes pre-installed on Ubuntu. If you see this error, make sure you are running the command inside your WSL Ubuntu terminal, not a Windows PowerShell or Command Prompt window.

Help me fix this openssl command not found error in WSL.

Generate SHA-512 hashes for a harder challenge

SHA-512-crypt is a stronger hashing algorithm than MD5-crypt. These hashes take longer to crack, which makes them a better test of John's advanced modes.

  • Generate two SHA-512-crypt hashes and save them to sha512-hashes.txt by running these commands:
# Generate SHA-512-crypt ($6$) hashes with mixed-strength passwords
echo "user4:$(openssl passwd -6 -salt roundsalt 'Summer2024!')" > sha512-hashes.txt
echo "user5:$(openssl passwd -6 -salt quicksalt qwerty)" >> sha512-hashes.txt

What does this code do?

The -6 flag selects the SHA-512 algorithm, producing hashes that start with $6$. These are significantly harder to crack than MD5-crypt hashes.

Notice that Summer2024! is wrapped in single quotes to prevent the ! character from being interpreted by bash. The password qwerty is deliberately weak, while Summer2024! uses uppercase, digits, and a symbol.

  • Verify your SHA-512 hash file by running:
cat sha512-hashes.txt

You should see 2 lines, each starting with a username followed by a much longer $6$ hash string.

Hash output looks wrong or truncated?

Make sure you used the correct flag. The -1 flag produces MD5 ($1$) and the -6 flag produces SHA-512 ($6$). If you accidentally used -1 here, delete the file and re-run with -6.

Help me fix my sha512-hashes.txt file.

Download and prepare the rockyou.txt wordlist

A wordlist is a file containing millions of known passwords collected from real data breaches. John the Ripper will compare each word in the list against your hashes to find matches.

  • Create the wordlists directory and download rockyou.txt by running these commands:
# Create a directory to store wordlists
mkdir -p ~/wordlists

# Download the rockyou.txt wordlist (approximately 134 MB)
curl -L -o ~/wordlists/rockyou.txt https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt

What is rockyou.txt?

The rockyou.txt file contains approximately 14 million real passwords leaked from the RockYou breach in 2009. It is the most commonly used wordlist in password security testing.

The -L flag tells curl to follow redirects, which is necessary for GitHub release downloads. The -o flag specifies where to save the file.

This download is approximately 134 MB. It may take a minute or two depending on your connection speed.

  • Once the download completes, verify the wordlist by running:
wc -l ~/wordlists/rockyou.txt

You should see approximately 14 million lines in the output. This confirms the wordlist downloaded successfully.

Download failed or shows 0 bytes?

Check your internet connection inside WSL. Run ping google.com to test connectivity. If DNS resolution fails, you may need to restart your WSL instance by running wsl --shutdown in Windows PowerShell and reopening your Ubuntu terminal.

Help me troubleshoot this curl download in WSL.

Your hash files and wordlist are ready. Next up, you will unleash John the Ripper on these hashes and watch it crack the passwords in seconds.

Crack Hashes with Wordlist and Rules

You have sample hashes ready to go. Now it is time to put John the Ripper to work cracking them.

Password crackers use different attack modes depending on the password's complexity. A wordlist attack compares hashes against a list of known passwords. A rules attack applies transformations to wordlist entries. A mask attack generates candidates matching a specific pattern. You will try all three in this step.

In this step, get ready to:
  • Crack MD5-crypt hashes using a wordlist attack with rockyou.txt.
  • Crack SHA-512-crypt hashes using wordlist mode with rules enabled.
  • Use mask mode to target a specific password pattern.
Crack MD5 hashes using wordlist mode

A wordlist attack is the fastest approach for common passwords. John compares each hash against precomputed hashes of every password in the wordlist. Since rockyou.txt contains over 14 million real leaked passwords, any common password will crack in seconds.

  • Navigate to your project directory by running this command:
cd ~/password-audit
  • Launch the wordlist attack against your MD5-crypt hashes by running:
john --wordlist=~/wordlists/rockyou.txt hashes.txt

What does this command do?

  • --wordlist=~/wordlists/rockyou.txt tells John to try every password in the rockyou wordlist.
  • hashes.txt is the target file containing your three MD5-crypt hashes.
  • John auto-detects the $1$ prefix as md5crypt format. You do not need to specify --format manually.
  • Display the cracked passwords by running:
john --show hashes.txt

You should see all three passwords revealed: password123, letmein, and dragon. These are extremely common passwords that appear near the top of rockyou.txt, so they crack almost instantly.

Seeing "No password hashes left to crack"?

John stores every cracked password in a pot file at ~/.john/john.pot. If you run the same command again, John skips hashes it already cracked.

To see your results, run john --show hashes.txt. To force John to re-crack the same hashes, delete the pot file with rm ~/.john/john.pot and try again.

help me understand why John says there are no hashes left to crack

Crack SHA-512 hashes with rules enabled

Your SHA-512 hashes include stronger passwords. The --rules flag tells John to apply word mangling transformations to each wordlist entry. This means it tries variations like capitalizing letters, appending numbers, and substituting characters.

  • Run the wordlist attack with rules enabled against your SHA-512 hashes:
john --wordlist=~/wordlists/rockyou.txt --rules sha512-hashes.txt

What does the --rules flag do?

Without --rules, John tries each wordlist entry exactly as-is. With --rules, John uses the default [List.Rules:Wordlist] section from its config file to generate variations of each word.

For example, the word "password" also gets tested as "Password", "password1", "PASSWORD", "p@ssword", and hundreds of other mutations. This dramatically increases the chance of cracking passwords that are slight variations of dictionary words.

  • Check the results by running:
john --show sha512-hashes.txt

You should see that qwerty cracked successfully. The password Summer2024! may still resist the wordlist and rules attack because it combines a capitalized word, a year, and a symbol in a pattern that needs a more targeted approach.

Rules attack taking too long?

The rules attack generates many more candidates than a plain wordlist run. On a typical WSL setup, it may take a few minutes to finish processing all 14 million entries with transformations applied.

Press any key to see progress status. Press q to quit early if needed. Any passwords cracked before quitting are saved to the pot file.

help me figure out why my rules attack is running slowly or not finding results

Use mask mode for pattern-based cracking

Mask mode generates password candidates that match a specific character pattern you define. Instead of relying on a wordlist, you describe the structure of the password using placeholders for character types.

  • Target the remaining uncracked hash with a mask attack by running:
john --mask='?u?l?l?l?l?l?d?d?d?d?s' sha512-hashes.txt

What does this mask pattern mean?

Each ? placeholder represents one character position with a specific character set:

  • ?u = one uppercase letter (targets the "S" in Summer).
  • ?l = one lowercase letter (targets "ummer"). Five ?l placeholders cover five lowercase characters.
  • ?d = one digit (targets "2024"). Four ?d placeholders cover four digits.
  • ?s = one special character (targets the "!" at the end).

This mask generates every possible combination matching the pattern: one uppercase, five lowercase, four digits, one symbol. The password Summer2024! fits this pattern exactly.

The mask attack may take some time as it tries all combinations matching the pattern. John will display cracked passwords as it finds them.

  • Verify all cracked SHA-512 hashes by running:
john --show sha512-hashes.txt

You should now see both passwords listed: qwerty (cracked by the earlier wordlist + rules attack) and Summer2024! (cracked by the mask attack).

Why use different attack modes?

Each attack mode targets a different class of password. Wordlist mode handles passwords that appear verbatim in leaked databases. Rules mode catches common variations of dictionary words. Mask mode targets passwords that follow a structural pattern but use unpredictable characters within that pattern.

Professional password auditors combine all three modes to maximize coverage. The order matters: start with the fastest attack (wordlist), then escalate to more computationally expensive approaches (rules, then mask) for stubborn hashes.

Mask attack not cracking the password?

Make sure the mask pattern matches the target password structure exactly. If you have a typo in the mask (wrong number of ?l or ?d placeholders), the correct password will never be generated as a candidate.

If John says there are no hashes left to crack, it means both passwords in sha512-hashes.txt were already cracked by the previous rules attack. Run john --show sha512-hashes.txt to confirm.

help me troubleshoot my mask attack on SHA-512 hashes

You have cracked passwords across multiple hash formats using three different attack strategies. Next up, you will extract and crack a password-protected ZIP file to see how John handles real-world encrypted archives.

Crack a Password-Protected ZIP File

So far you have cracked standalone hashes that you generated with openssl. In the real world, attackers and auditors frequently encounter password-protected files rather than raw hash strings.

In this step, you will create a password-protected ZIP archive, extract its hash using a purpose-built tool, and crack it with John the Ripper. This demonstrates the full file-based cracking workflow from extraction to recovery.

In this step, get ready to:
  • Create a password-protected ZIP file as your cracking target.
  • Extract the ZIP password hash and crack it using a wordlist attack.
Create a password-protected ZIP file

Before you can crack a ZIP file, you need one to practice on. You will create a simple text file, lock it inside a password-protected archive, then delete the original so only the locked ZIP remains.

  • Install the zip utility by running this command:
sudo apt-get -y install zip

Why install zip separately?

Ubuntu's default WSL installation does not include the zip command. The -y flag automatically confirms the installation so you don't need to type 'yes' at a prompt.

  • Navigate to your project directory and create the password-protected ZIP by running these commands:
cd ~/password-audit
echo "This is a secret document" > secret.txt
zip -P s3cur3 secret.zip secret.txt
rm secret.txt

What do these commands do?

The echo command creates a text file called secret.txt with sample content.

The zip -P s3cur3 command packages secret.txt into secret.zip with the password s3cur3. The -P flag sets the password directly from the command line.

Finally, rm secret.txt removes the original file so the only way to access its contents is by cracking the ZIP password.

  • Verify the ZIP file exists and is protected by running:
ls secret.zip
unzip -t secret.zip

You should see secret.zip listed, and unzip -t will prompt you for a password before it can test the archive. Press Ctrl+C to cancel the prompt without entering a password.

Seeing 'zip: command not found'?

Make sure the sudo apt-get -y install zip command completed without errors. Run it again if needed. If you see a permission error, confirm you are typing sudo at the start.

help me fix a zip command not found error in WSL Ubuntu

Extract the hash and crack it

John the Ripper cannot crack a ZIP file directly. It needs the password hash extracted into a text format first.

What is zip2john?

The zip2john utility is bundled with John the Ripper Jumbo in the run/ directory. It reads a password-protected ZIP file and outputs the hash in a format that John can process.

  • Extract the password hash from secret.zip by running this command:
~/src/john/run/zip2john secret.zip > zip-hash.txt

What does this command do?

This runs zip2john on your ZIP file and redirects the extracted hash into zip-hash.txt. The output file contains the hash data John needs to attempt cracking.

You use the full path ~/src/john/run/zip2john because only the john binary itself was aliased in an earlier step.

  • Confirm the hash was extracted by checking the file contents:
cat zip-hash.txt

You should see a line starting with secret.zip/secret.txt followed by a long hash string.

  • Crack the ZIP hash using your rockyou.txt wordlist by running:
john --wordlist=~/wordlists/rockyou.txt zip-hash.txt

What is happening here?

John auto-detects the hash format from zip-hash.txt and identifies it as a PKZIP or ZIP archive hash. It then tests every password in rockyou.txt against the hash until it finds a match.

Since s3cur3 is a common password pattern found in the rockyou wordlist, John should crack it within seconds.

  • Display the cracked password by running:
john --show zip-hash.txt

You should see output showing s3cur3 as the recovered password for secret.zip.

Seeing 'No password hashes left to crack'?

This means John already cracked the hash in a previous run and stored the result in its pot file. The cracked passwords are saved in ~/.john/john.pot. Run john --show zip-hash.txt to see the previously cracked password.

If you want to re-run the crack from scratch, delete the pot file first with rm ~/.john/john.pot and then run the crack command again.

help me troubleshoot John the Ripper showing no password hashes left to crack

You have now completed the full file-based cracking workflow. Next up, you will document your entire audit process in a professional GitHub repository.

Document and Push to GitHub

You have cracked passwords across multiple hash formats and extracted secrets from a ZIP file. Now it is time to turn your work into a shareable, professional artifact.

Without documentation, your audit is just a collection of hash files. A well-structured GitHub repository with a clear README transforms it into proof of your methodology. In this step, you will initialize a Git repository, write a professional README, and push everything to GitHub.

In this step, get ready to:
  • Initialize a Git repository and create a professional README documenting your audit.
  • Stage your audit files and make an initial commit.
  • Push your repository to GitHub for public access.
Initialize Git repository and create README

Your ~/password-audit directory already has all the hash files and cracked results from the previous steps. You will turn this directory into a Git repository and write a README that documents everything.

  • Make sure you are in your project directory by running this command:
cd ~/password-audit
  • Initialize a new Git repository by running:
git init

You should see a message confirming the repository was initialized.

What does git init do?

This command creates a hidden .git/ folder inside ~/password-audit. That folder is where Git stores all version history, branches, and configuration for the project.

  • Create your README.md file by running this command:
cat > README.md << 'EOF'
# Password Security Audit Lab

## Description

A hands-on password security audit demonstrating hash cracking techniques using John the Ripper. This project explores how weak passwords are identified through various attack modes, helping security professionals understand password vulnerabilities.

## Tools Used

- **John the Ripper Jumbo** (bleeding-jumbo branch, compiled from source)
- **OpenSSL** (hash generation)
- **WSL Ubuntu** (Linux environment on Windows)

## Methodology

### 1. Hash Generation

Generated sample password hashes using OpenSSL:
- MD5-crypt ($1$) hashes with known weak passwords
- SHA-512-crypt ($6$) hashes with stronger passwords

```bash
openssl passwd -1 -salt testsalt password123
openssl passwd -6 -salt roundsalt Summer2024!
```

### 2. Wordlist Attack

Used the rockyou.txt wordlist (14+ million passwords) to crack common passwords:

```bash
john --wordlist=~/wordlists/rockyou.txt hashes.txt
```

### 3. Rules Attack

Applied word mangling rules to expand wordlist coverage:

```bash
john --wordlist=~/wordlists/rockyou.txt --rules sha512-hashes.txt
```

### 4. Mask Attack

Targeted specific password patterns using character class masks:

```bash
john --mask='?u?l?l?l?l?l?d?d?d?d?s' sha512-hashes.txt
```

### 5. ZIP File Extraction

Extracted and cracked a password-protected ZIP file:

```bash
~/src/john/run/zip2john secret.zip > zip-hash.txt
john --wordlist=~/wordlists/rockyou.txt zip-hash.txt
```

## Results

| Hash File | Algorithm | Password | Attack Mode | Time |
|-----------|-----------|----------|-------------|------|
| hashes.txt | MD5-crypt | password123 | Wordlist | < 1s |
| hashes.txt | MD5-crypt | letmein | Wordlist | < 1s |
| hashes.txt | MD5-crypt | dragon | Wordlist | < 1s |
| sha512-hashes.txt | SHA-512 | qwerty | Wordlist | < 1s |
| sha512-hashes.txt | SHA-512 | Summer2024! | Rules/Mask | Varies |
| zip-hash.txt | PKZIP | s3cur3 | Wordlist | < 1s |

## Ethical Disclaimer

This project is for **educational purposes only**. Password cracking techniques should only be used on systems you own or have explicit written authorization to test. Unauthorized access to computer systems is illegal under laws such as the Computer Fraud and Abuse Act (CFAA). Always practice responsible disclosure and ethical hacking principles.
EOF

What does this README cover?

The README documents every aspect of your audit in a structured, professional format. It includes the tools you used, the methodology you followed at each stage, the exact commands for reproducibility, and a results table showing which passwords cracked and how.

The ethical disclaimer is important. It signals to anyone reading your repository that you understand the legal and ethical boundaries of security testing.

  • Verify your README was created by running:
ls

You should see README.md listed alongside your hash files.

Don't see README.md?

Make sure you copied the entire cat command including the EOF at the end. The heredoc syntax requires that closing EOF to appear on its own line with no leading spaces.

help me fix my README.md creation in WSL

Stage files and make initial commit

You want to commit your audit documentation and hash files, but not the massive rockyou.txt wordlist or any plaintext cracked passwords. Since rockyou.txt lives in ~/wordlists/ (outside this repository) and cracked passwords are stored in John's pot file, you can safely stage everything in this directory.

  • Stage all files in the project directory by running:
git add .
  • Confirm what is staged by running:
git status

You should see README.md, hashes.txt, sha512-hashes.txt, zip-hash.txt, and secret.zip listed as new files ready to be committed.

Why is rockyou.txt not staged?

The rockyou.txt wordlist lives in ~/wordlists/, which is completely outside your ~/password-audit repository. Git only tracks files within the repository directory. The cracked passwords are stored in John's pot file at ~/.john/john.pot, also outside the repo.

  • Make your initial commit by running:
git commit -m "Initial commit: password security audit lab"
  • Verify the commit was created by running:
git log

You should see your commit with the message "Initial commit: password security audit lab" at the top of the log.

Seeing an author identity error?

If Git asks you to set your name and email, run the following two commands with your own details before retrying the commit:

git config --global user.email "you@example.com"
git config --global user.name "Your Name"

help me fix my Git identity configuration in WSL

Push to GitHub

Your local repository is ready. Now you will create a matching repository on GitHub and push your code to it.

  • Open your browser and go to github.com.
  • Click the + icon in the top right corner.
  • Select New repository.
  • Enter password-security-audit as the repository name.
  • Leave the repository set to Public.
  • Do NOT check "Add a README file" since you already have one.
  • Click Create repository.

Why leave the repo empty on GitHub?

If you add a README or .gitignore on GitHub, it creates an initial commit that conflicts with your local commit. Starting with an empty repository on GitHub lets you push your local history cleanly.

  • Back in your WSL terminal, connect your local repository to GitHub by running:
git remote add origin https://github.com/[[GITHUB_USERNAME="YOUR-USERNAME"]]/password-security-audit.git
  • Rename your branch to main by running:
git branch -M main
  • Push your repository to GitHub by running:
git push -u origin main

What do these commands do?

  • git remote add origin links your local repo to the GitHub URL so Git knows where to push.
  • git branch -M main renames your default branch to main (GitHub's default branch name).
  • git push -u origin main uploads your commits and sets origin/main as the default upstream for future pushes.
  • Refresh your GitHub repository page in the browser.

You should see your README rendered with the project title, methodology, results table, and ethical disclaimer all displayed on the repository's main page.

Push failed with authentication error?

GitHub no longer accepts passwords for HTTPS pushes. You need a Personal Access Token (PAT) instead. Go to Settings > Developer settings > Personal access tokens on GitHub to generate one.

When Git prompts for your password, paste the token instead. Alternatively, configure SSH keys for password-free authentication.

help me authenticate Git with GitHub in WSL

Secret mission

Custom Rules Attack

You've cracked passwords using the default rockyou.txt wordlist. But what about passwords that don't appear in any wordlist? In this secret mission, you'll write custom John the Ripper rules that apply leet-speak transformations and pattern-based appending to crack a password that resists standard dictionary attacks.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally on WSL, so there are no ongoing costs.

Resources you used:

  • John the Ripper compiled binaries in ~/src/john/.
  • Project directory at ~/password-audit/ (hash files, ZIP file, custom rules, README).
  • Rockyou.txt wordlist at ~/wordlists/rockyou.txt (approximately 133 MB).
  • GitHub repository password-security-audit.
  • Shell alias for john in ~/.bashrc.

Keep everything running

No action needed. Choose this if you plan to continue experimenting with John the Ripper, try additional hash formats, or expand your audit documentation.

  • Your compiled John the Ripper stays ready to use via the john alias.
  • Your project files and GitHub repo remain intact for future reference or portfolio use.
  • The rockyou.txt wordlist takes up approximately 133 MB of disk space.

Pause - I'll come back to this later

Free up disk space by removing the large wordlist file while keeping your project files and John the Ripper installation intact.

  • Remove the wordlist to reclaim disk space by running:
rm ~/wordlists/rockyou.txt
  • Your ~/password-audit/ project directory and ~/src/john/ installation stay in place.
  • When you come back, re-download rockyou.txt using the same curl command from Step 2.

Delete - I don't want to use this again

Remove all project resources from your local machine and GitHub. This is a full cleanup.

  • Delete the project directory, John the Ripper installation, and wordlist by running:
rm -rf ~/password-audit
rm -rf ~/src/john
rm -rf ~/wordlists
  • Remove the john alias from your shell configuration. Open ~/.bashrc in a text editor:
nano ~/.bashrc
  • Find the line alias john="~/src/john/run/john" and delete it. Save the file with Ctrl+O, then exit with Ctrl+X.
  • Reload your shell configuration by running:
source ~/.bashrc
  • Delete the GitHub repository. Go to your repository page on GitHub.
  • Click Settings in the top navigation bar.
  • Scroll to the bottom of the page to the Danger Zone section.
  • Click Delete this repository and follow the confirmation prompts.
  • Clear John the Ripper's pot file (stores previously cracked passwords) by running:
rm -f ~/.john/john.pot
  • Verify everything is removed by running:
ls ~/password-audit ~/src/john ~/wordlists 2>&1

You should see "No such file or directory" for each path.

Nice Work!

Nice Work!

Nice work! You just built a complete password security audit lab from scratch using John the Ripper on WSL. You now understand how attackers exploit weak passwords and how to test password strength professionally.

You learned how to:

  • Built John the Ripper Jumbo from source on WSL and cracked passwords across multiple hash formats including MD5-crypt and SHA-512-crypt.
  • Used different attack modes including wordlist attacks, rule-based mangling, and mask attacks to crack passwords of varying complexity.
  • Extracted and cracked a password-protected ZIP file using zip2john, then documented the full audit methodology in a professional GitHub repository.
  • Secret Mission: Wrote custom John the Ripper cracking rules to defeat passwords that resist standard wordlist attacks.

Ready to quiz yourself?