Lab 5: Breaking Password – Brute Force Attack

Umesh Malik

I am the founder of Assignments Plus, a platform dedicated to delivering academic content. With extensive experience as a Senior Content Writer specializing in Commerce, Management, and Business Analytics, I have a proven track record of creating impactful, well-researched assignments for students and professionals globally. My expertise spans Power BI, HTML, CSS, and JavaScript, allowing me to merge technical precision with clear, engaging writing. At Assignments Plus, I leverage this unique combination to provide high-quality, tailored solutions that help learners achieve academic excellence. Passionate about education and data-driven storytelling, I am committed to empowering success through expertly crafted content.

February 5, 2026

Activity And In-Class

Get Your Assignment Quote Now

Calculate your price instantly • Best quality guaranteed • Lowest prices

Premium QualityBest Price GuaranteeInstant Quote

Calculate Price Now

Lab 5: Breaking Password – Brute Force Attack

John the Ripper

John the Ripper is a free password cracking software tool. Originally developed for the Unix operating system, it can run on fifteen different platforms (eleven of which are architecture-specific versions of Unix, DOS, Win32, BeOS, and OpenVMS). It is among the most frequently used password testing and breaking programs as it combines a number of password crackers into one package, autodetects password hash types, and includes a customizable cracker. It can be run against various encrypted password formats including several crypt password hash types most commonly found on various Unix versions (based on DES, MD5, or Blowfish), Kerberos AFS, and Windows NT/2000/XP/2003 LM hash. Additional modules have extended its ability to include MD4-based password hashes and passwords stored in LDAP, MySQL, and others.

Attack Types

One of the modes John can use is the dictionary attack. It takes text string samples (usually from a file, called a wordlist, containing words found in a dictionary or real passwords cracked before), encrypting it in the same format as the password being examined (including both the encryption algorithm and key), and comparing the output to the encrypted string. It can also perform a variety of alterations to the dictionary words and try these. Many of these alterations are also used in John's single attack mode, which modifies an associated plaintext (such as a username with an encrypted password) and checks the variations against the hashes.

John also offers a brute force mode. In this type of attack, the program goes through all the possible plaintexts, hashing each one and then comparing it to the input hash. John uses character frequency tables to try plaintexts containing more frequently used characters first. This method is useful for cracking passwords that do not appear in dictionary wordlists, but it takes a long time to run.

Today’s Lab:

• Download and install Winrar from https://www.win-rar.com/predownload.html?&L=0&Version=32bit
• Create a PDF file and save it as your name, i.e. JohnDoe.PDF
• Right click on the PDF file, click on Winrar, and click on “Add to archive”
• On the window that pops up, click on “set password” and set the password as the first 5 characters of your name (provide screenshot). Now, when you try to open the password protected file (i.e. JohnDoe.rar), you will need to enter the password.

• Download John the Ripper tool from https://www.openwall.com/john/, and extract it.
• Move the password protected PDF file to the Run folder, inside of the extracted John the Ripper tool folder.
• In CMD, go to the Run folder, inside of the extracted John the Ripper folder, and run the command: (provide screenshot)
rar2john.exe YourName.RAR
(i.e.: rar2john.exe JohnDoe.RAR)
Running the above command, results in showing the hash value.

• Run the command once again, but this time export the output to a file, using the command below: (provide screenshot)
rar2john.exe YourName.RAR > hash.txt
(i.e.: rar2john.exe JohnDoe.RAR > hash.txt)

• Now, in CMD, run the command: John hash.txt (provide screenshot)
It will take a few minutes to break the password.

• Once the process completed, highlight the broken password. (provide screenshot)

• Add the screenshots in a doc file, explain the process, and submit through Moodle.

Important points:

• Labs are in-class activities. Therefore, submitting outside of class and the defined hours is an example of unethical behaviour (academic misconduct). For any late submission, you MUST apply for special consideration before or on the assessment date. ONLY upon getting the approval of the special consideration, a second attempt will be arranged.
• The submitted Doc/PDF file should contain at least 20 words. Otherwise, Turnitin will reject it.
• Only Doc/PDF files are acceptable. Images (screenshots) or other formats will not be marked.
• Do not crop the screenshots.
• Once you submitted a report, please ensure Turnitin has accepted your file. The rejected submissions will not be graded.
• If instructed in the assignment, the screenshots MUST show your name. The answers which do not meet the defined criteria will receive 0 mark, even if the answer is correct.

Source: https://www.youtube.com/watch?v=6KC5R8I3bKQ