Lion Cipher Lab
Crack your OWN password hashes with John the Ripper
- Penetration Testing / Red Team
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Almost every login you own is protected not by your password itself but by a hash of it — a scrambled fingerprint the service stores so it never has to keep the real password. When a company gets breached, what leaks is usually that file of hashes, and attackers then try to reverse them offline, on their own machines, with no rate limit to stop them. Whether your password survives that offline assault comes down to two things: how strong and unique YOUR password was, and how carefully THEY hashed it (with a salt, with a slow algorithm). This lab lets you stand on both sides of that fight…
What you'll learn
- understanding what a password hash is and why systems store hashes instead of passwords
- installing John the Ripper (the jumbo build) on Windows, macOS, or Linux
- opening a terminal and running commands with confidence, from zero
- generating your own test hashes of throwaway example passwords with a Python one-liner
- running John in wordlist mode and reading which passwords it recovers
- seeing firsthand that weak, common, and dictionary passwords fall almost instantly
- proving that an unsalted hash of a password is always the same, so it is vulnerable to precomputed tables
- seeing that a salted hash makes two identical passwords produce different hashes
- feeling why a deliberately slow hash (bcrypt) makes offline cracking far harder than a fast one (MD5)
- stating the defender's password checklist: long unique passphrases, a manager, salted slow hashing
Steps in this lab
- First, the ground rules: your machine, your throwaway passwords, nobody else
- What a password hash actually is, and why cracking is even possible
- Open a terminal (from zero)
- Install John the Ripper
- Generate your OWN file of throwaway hashes
- Turn John loose: crack your weak hashes with a wordlist
- Why reuse is the silent killer
- Add a salt: why two identical passwords should hash differently
- Add slowness: watch John crawl against bcrypt
- What you proved, and the checklist to carry