The pattern 12345 is much more likely than 54321, so it is checked first resulting in a quick crack.

If you take a look at nf in the run directory, it has a list of the patterns it checks (in order). But this means you could try to crack more than one zip/rar file at a time.įor the rar file it did not take nearly as long since the password was relatively common. For example, we cannot put the rar AND zip hashes in the same file. Note: the hash file should have the same type of hashes.

Now if you want to see the cracked passwords give john the following arguments: On a 64bit quad-core i7 system, without using GPU, and while doing some other CPU-intensive tasks, the password was cracked in 6.5 hours. Now sit back and wait for the cracking to finish. If you have a multi-processor system, it will greatly speed up the cracking process. If you look at your processor usage, if only one is maxed out, then you did not enable OpenMP when building. You could potentially speed the cracking process up if you have an idea what the password may be. Notice, in this case we are not using explicit dictionaries. See the examples page for more information on modes. By using John with no options it will use its default order of cracking modes. You should get a message like: Loaded 1 password hash (PKZIP ). This will give you files that contain the password hashes to be cracked. Run them against their respective file types to extract the password hashes: In the 'run' folder of John the Ripper community version (I am using John-1.7.9-jumbo-7), there are two programs called 'zip2john' and 'rar2john'.

The password for the rar file is 'test1234' and the password for the zip file is 'test4321'.

Test.zip: Zip archive data, at least v1.0 to extract Test.rar: RAR archive data, v1d, os: Unix For this exercise I have created password protected RAR and ZIP files, that each contain two files.

Zip cracker