I am playing about with 'John the ripper' to see how easily my password can be cracked. The only issue i I cannot seem to fin the hashed password.
Things I've tried.
- Reading hash from
/etc/passwd- Result: No user found
sudo dscl . -read /Users/<user>/ | grep GeneratedUID | cut -c15-
cat /var/db/shadow/hash/<Result From First Command> | cut -c169-216- Result: directory 'shadow' does not exist
- Some others (forgotten what they were. Had similar issues.
This also didn't work for me.
Would like to know where the password hash is for my user so I can test out JTR.
Thanks in advanced.
When I do
sudo defaults read /var/db/dslocal/nodes/Default/users/Test.plist ShadowHashData|tr -dc 0-9a-f|xxd -r -p|plutil -convert xml1 - -o - I get 2 hashes
weXOBzKgCTzoeamwRXZ8vLNQNrHyCyFk/ZD2Bc/Vb6c= However when I put 'Test:' in a text file and do
./john <file> It gives me 'No password hashes loaded'.
Is this an issue with how I'm using John The Ripper or am I getting the wrong hashes?
Note: This was a test user and this is not my real password hashed. The encrypted password is 'password'