🎯 certification ready Hands-on labs + knowledge assessment
📋 lab-based examHello, future cyber hero! 👋
Have you ever forgotten your password? Or maybe you wanted to see if your password is strong enough to stop a bad guy?
In this module, we are going to learn about John the Ripper – a super cool tool that helps us test passwords. But wait! We only use it for good, like helping people recover lost passwords or checking if our own passwords are safe. Think of John as a friendly robot that checks locks on doors to make sure they are strong.
By the end of this module, you will know what John the Ripper is, why it is important, and how it works in a very simple way. We will use many stories, examples, and fun pictures made with text. Are you ready? Let’s go! 🚀
After finishing this module, you will be able to:
Once upon a time, in a small village called Cyberville, there was a wise old woman named Grandma Ada. Grandma Ada had a big treasure chest full of family recipes. She locked it with a special key. But one day, she forgot where she hid the key! 😱
Her grandson, Kofi, was a clever boy. He said, “Grandma, don’t worry! I will find the key.” But the key was gone. So Kofi thought, “What if I make a big list of all the possible keys that look like Grandma’s key? Then I will try each one until the lock opens.”
Kofi wrote down thousands of key shapes on paper. He tried them one by one. After a few hours, he found the right key! The chest opened, and Grandma was so happy. She gave Kofi a big hug and a plate of her famous chin chin. 🍪
That is exactly what John the Ripper does! It tries many passwords (like keys) until it finds the right one. But John is much faster than Kofi because it is a computer program. And instead of a treasure chest, it opens password-protected files.
Now, let’s learn how John works, step by step.
Definition: A password is a secret word or set of characters that you use to prove you are you.
Why it is important: Passwords protect our accounts – like email, games, and bank apps – from people who should not see them.
Simple explanation: Imagine a password is like a secret knock on your treehouse door. Only friends who know the knock can come in.
Real‑life example: You type a password to unlock your tablet.
School example: You need a password to log into the school computer lab.
Home example: Your parent uses a password to unlock their phone.
Nigerian example: Many Nigerians use passwords to access their bank apps like GTWorld or Access Mobile.
Illustration (ASCII):
🏠 TREEHOUSE DOOR
|
v
🔑 Secret knock: “tap tap tap-tap”
If you know it → door opens ✅
If you don’t → door stays closed ❌
Mini summary: A password is a secret key. Only you and trusted people should know it.
Definition: John the Ripper is a free computer program that tests passwords to see if they are weak.
Why it is important: It helps people find weak passwords before bad guys do.
Simple explanation: John is like a robot that tries to guess your password by checking a very long list of words and patterns.
Real‑life example: A security expert uses John to test company passwords.
School example: Your IT teacher uses John to show how easy it is to guess short passwords.
Home example: You can use John (with permission) to check if your family’s Wi‑Fi password is strong.
Nigerian example: A bank in Lagos uses John to test that their staff use strong passwords.
Illustration (ASCII):
👤 SECURITY EXPERT
|
v
⚙️ John the Ripper ⚙️
(password tester)
|
v
📋 Report: “Weak password found!”
Mini summary: John the Ripper is a helpful tool that tests passwords for weakness.
Definition: John works by comparing encrypted passwords (called hashes) against guesses.
Why it is important: Understanding how John works helps us use it correctly.
Simple explanation: The computer does not store your password in plain text. It turns it into a secret code (hash). John tries to find a word that, when turned into the same secret code, matches.
Real‑life example: It’s like a restaurant giving you a number for your order. The kitchen doesn’t remember your name; it just matches the number to the food.
School example: Your student ID number is like a hash. The school uses the ID to find your records.
Home example: Your parent’s fingerprint on the phone is turned into a code.
Nigerian example: When you pay with USSD, your bank uses a code to verify you.
Illustration (ASCII):
Password: “ILOVEJOHN”
|
v
[ Hash machine ]
|
v
Hash: 5f4dcc3b5aa765d61d8327deb882cf99
Mini summary: John turns guesses into hashes and compares them to find a match.
Definition: A dictionary attack uses a list of common words (a wordlist) to guess passwords.
Why it is important: Many people use common words like “password” or “123456”. John finds them quickly.
Simple explanation: Imagine you have a big book of the most common passwords. John reads that book and tries each one.
Real‑life example: A hacker uses a list of 10,000 common passwords to break into accounts.
School example: Your teacher shows how “student” is a weak password.
Home example: Your neighbour’s Wi‑Fi password might be “wifi123”.
Nigerian example: Some people use “lagos2020” – that would be in a dictionary attack list!
Illustration (ASCII):
📖 WORD LIST
+--------------+
| password |
| 123456 |
| letmein |
| lagos2020 |
| iloveyou |
+--------------+
|
v
⚙️ John tries each word
|
v
✅ Match found: “lagos2020”
Mini summary: A dictionary attack is fast and works on common passwords.
Definition: Brute‑force means trying every possible combination of letters, numbers, and symbols.
Why it is important: This attack can find any password, but it takes a very long time.
Simple explanation: It’s like trying to open a lock by testing every key in the world – one by one.
Real‑life example: If you have a 4‑digit PIN, there are 10,000 combinations. John tries all of them.
School example: If a password is “a”, then “b”, then “c” … up to “zzzz”.
Home example: Trying all possible 4‑number codes on a bike lock.
Nigerian example: A cybercafe owner might test all simple passwords on old computers.
Illustration (ASCII):
Start: a
|
v
Try a, b, c, ... aa, ab, ...
|
v
⏳ After 1,000,000 tries ...
|
v
✅ Found: “cat99”
Mini summary: Brute‑force tries everything but is very slow.
Definition: A hash is a fixed‑length string that looks like gibberish, made from your password.
Why it is important: It keeps your password safe because the real password is not stored.
Simple explanation: Imagine a magic machine that turns every word into a special number. “Cat” becomes “f5a…”. You cannot turn it back.
Real‑life example: Websites store hashes, not your password.
School example: The school library uses a hash for your student ID.
Home example: Your game console uses a hash to check your login.
Nigerian example: Banks use hashing to protect your PIN.
Illustration (ASCII):
Password: “BOLA”
|
v
🔐 HASH 🔐
|
v
Hash: 81dc9bdb52d04dc20036dbd8313ed055
Mini summary: A hash is a one‑way code that hides your password.
Definition: A wordlist is a text file containing many possible passwords.
Why it is important: Wordlists make dictionary attacks fast and effective.
Simple explanation: It’s like a cheat sheet for a spelling bee – John uses it to guess.
Real‑life example: Security testers use wordlists like rockyou.txt.
School example: A teacher gives a list of 50 common passwords for a class demo.
Home example: You can make a list of family pet names to test your own password.
Nigerian example: A wordlist might include “nigerian”, “abuja”, “lagos”.
Illustration (ASCII):
wordlist.txt
+-------------+
| abuja |
| lagos |
| port-harcourt|
| naija |
| 9ja |
+-------------+
Mini summary: Wordlists are lists of guesses that John uses.
Definition: Rules are patterns that modify words, like adding numbers or changing letters.
Why it is important: They help John guess variations like “password1” or “P@ssw0rd”.
Simple explanation: If John knows “cat”, it will also try “Cat”, “cat1”, “c@t”, and “cat!”.
Real‑life example: Many people use “password” and then add a number.
School example: Students often use their name + birth year.
Home example: Your parent might use “mum2023”.
Nigerian example: “Chidi” becomes “Chidi123” or “Chidi@2024”.
Illustration (ASCII):
Base word: “chidi”
Rules:
+ add 1 → “chidi1”
+ uppercase → “Chidi”
+ substitute i→! → “ch!d!”
Mini summary: Rules make John smarter by trying common changes.
Definition: John the Ripper is legal when used with permission for ethical purposes.
Why it is important: Using it without permission is illegal and wrong.
Simple explanation: John is like a lock‑pick set. It’s okay for locksmiths to use it, but not for thieves.
Real‑life example: Companies hire ethical hackers to test their systems.
School example: Your teacher uses John to teach about security.
Home example: You ask your parents before testing their passwords.
Nigerian example: Many Nigerian cybersecurity professionals use John for defence.
Illustration (ASCII):
👨💻 Ethical hacker (good) 🦹 Bad guy (evil)
+ Permission? YES NO
+ Help people? YES NO
+ Legal? YES NO
Mini summary: Always use John ethically and with permission.
Definition: A strong password is long, complex, and unique.
Why it is important: It takes John a very long time to crack it.
Simple explanation: Make your password at least 12 characters, mix letters, numbers, and symbols.
Real‑life example: “M1ch3al!23#” is stronger than “michael”.
School example: Your teacher says: use a sentence like “I love Ice-cream 2024!”.
Home example: Your family Wi‑Fi password should be strong.
Nigerian example: “LagosIsFun@9ja” is better than “lagos”.
Illustration (ASCII):
Weak password: "ade" (3 chars) John cracks instantly
Strong password: "Adeola@2024!Fun" (16 chars) John takes years
Mini summary: Use long, mixed passwords to stay safe.
Definition: A hash file contains the hashed passwords that John tries to crack.
Why it is important: John cannot work without a hash file.
Simple explanation: It’s like a list of locked boxes. John tries to open them.
Real‑life example: The Linux /etc/shadow file stores user hashes.
School example: A lab computer stores hashes of student passwords.
Home example: Your game account has a hash stored on the server.
Nigerian example: A bank server stores hashes of customer PINs.
Illustration (ASCII):
hashfile.txt
+----------------------------------+
| chidi:5f4dcc3b5aa765d61d... |
| bola:7c6a180b36896a0a8c... |
| tunde:6d7b3e1b2c3d... |
+----------------------------------+
Mini summary: John reads the hash file to start testing.
Definition: Speed depends on hardware and the type of hash.
Why it is important: Knowing speed helps estimate cracking time.
Simple explanation: A fast computer can try millions of passwords per second.
Real‑life example: A gaming PC is faster than an old laptop.
School example: School computers are slower than a supercomputer.
Home example: Your tablet is slower than a desktop.
Nigerian example: A cybercafe in Lagos may have slower machines.
Illustration (ASCII):
🐢 Old laptop: 100 tries/sec
🚗 Gaming PC: 1,000,000 tries/sec
🚀 Supercomputer: 10 billion tries/sec
Mini summary: Better hardware = faster cracking.
Definition: John has different modes: single crack, wordlist, and incremental.
Why it is important: Each mode is for different situations.
Simple explanation: It’s like having different tools for different locks.
Real‑life example: Single crack uses info from the hash file.
School example: Wordlist mode is used for common passwords.
Home example: Incremental mode is brute‑force.
Nigerian example: A security analyst uses wordlist mode first.
Illustration (ASCII):
John Modes
+------------------+
| Single crack | quick, uses account info
| Wordlist | uses dictionary
| Incremental | brute‑force (slowest)
+------------------+
Mini summary: John has different modes for different attacks.
Definition: Some passwords are too strong for John.
Why it is important: It shows that good passwords work.
Simple explanation: If your password is very long and random, John gives up.
Real‑life example: “Q$4n9kL!p2Xz@7f” is almost impossible.
School example: A 20‑character password with symbols.
Home example: Your router password with 16 random characters.
Nigerian example: Banks use very strong encryption, so John can’t crack them easily.
Illustration (ASCII):
Strong password: “I❤️CyberSecurity2025!!”
John tries: 💨 … tries … tries … ⏰ gives up after 100 years.
Mini summary: Very strong passwords defeat John.
Definition: A Certified John Ripper User knows how to use John ethically and effectively.
Why it is important: Certification shows you are skilled and responsible.
Simple explanation: Like a driving licence for using John.
Real‑life example: Many jobs ask for this skill.
School example: You learn it in a cybersecurity class.
Home example: You can help your family create stronger passwords.
Nigerian example: Nigerian companies look for certified security staff.
Illustration (ASCII):
🎓 CERTIFIED JOHN RIPPER USER
+----------------------------+
| Knows John commands |
| Uses wordlists |
| Understands hashes |
| Acts ethically |
| Helps protect people |
+----------------------------+
Mini summary: A certified user is a responsible security helper.
Illustration (flowchart):
Start
|
v
Read hash file
|
v
Choose wordlist
|
v
For each word:
|
+---> Apply rules
| |
+---> Hash the word
| |
+---> Compare to target
| |
+---> Match? ── Yes ──> Password found! ✅
| |
+---> No ──> Next word
|
v
End (if not found)
1996 ── John 1.0 released
2005 ── John 1.6 (new formats)
2010 ── John 1.7 (GPU support)
2015 ── John 1.8 (more hash types)
2024 ── John 1.9 (latest features)
| Feature | Dictionary Attack | Brute‑Force Attack |
|---|---|---|
| Speed | Fast ⚡ | Very slow 🐢 |
| Uses wordlist | Yes | No |
| Finds common passwords | Yes | Yes |
| Finds random passwords | No | Yes (but takes long) |
| Best for | Everyday weak passwords | Short or simple passwords |
+-------------------+
| Start |
+-------------------+
|
v
+-------------------+
| Load hash file |
+-------------------+
|
v
+-------------------+
| Choose wordlist |
+-------------------+
|
v
+-------------------+
| Apply rules |
+-------------------+
|
v
+-------------------+
| Hash each guess |
+-------------------+
|
v
+-------------------+
| Compare hashes |
+-------------------+
|
v
+-----------+--------+
| Match? | |
+-----------+--------+
| Yes | No
v v
+-----------+ +-----------+
| Password | | Next word |
| found! ✅ | | |
+-----------+ +-----------+
| Mode | Description | Speed |
|---|---|---|
| Single crack | Uses account info (username, etc.) | Very fast |
| Wordlist | Uses a dictionary file | Fast |
| Incremental | Brute‑force all combinations | Slow |
Congratulations! You have finished the first module of the Certified John Ripper User course. Let’s recap what we learned:
You now have a solid foundation. In the next module, we will get our hands dirty – we will install John and run our first test!
Match the term on the left with its description on the right.
| Term | Description |
|---|---|
| 1. Hash | A. List of common passwords |
| 2. Wordlist | B. Scrambled code |
| 3. Dictionary attack | C. Tries every combination |
| 4. Brute‑force | D. Uses a wordlist |
| 5. John the Ripper | E. Password testing tool |
Answers: 1‑B, 2‑A, 3‑D, 4‑C, 5‑E
Scenario 1: Chidi is a student at a university. He forgets his lab password and the IT admin gives him a hash file. Chidi uses John with a wordlist and finds his password in 5 minutes.
Scenario 2: Ada wants to test her online banking password. She downloads John but does not ask the bank. She tries to crack the bank’s hash.
Activity: In groups of 3, create a list of 20 common Nigerian passwords (e.g., “lagos”, “abuja”, “chi”, “nkechi”). Then, discuss how John could crack them. Present your findings to the class.
Activity: Write down 3 of your own passwords (dummy ones) and rate them as weak, medium, or strong. Explain why.
Project: Create a simple “password strength checker” using a wordlist. Write down 10 common passwords and mark which ones John would crack instantly. Draw an ASCII chart showing the results.
Assignment: Using a test hash (provided by your teacher), run John in wordlist mode. Write a short report (5 sentences) about what you found.
Challenge: Create a wordlist of 50 words that are related to Nigeria (cities, foods, names). Then, use John (if available) to crack a test hash. See how many passwords you can crack.
(Answers to Fill-in-the-Blank, True/False, and Multiple Choice are provided within each section.)
In the next module, we will learn how to install John the Ripper on your computer. We will run our first real test and see how John cracks passwords. Make sure you have a computer (Windows, Linux, or Mac) and ask your parent or teacher for permission.
Get ready to become a real Certified John Ripper User! 🎉
End of Module 1
Hello again, future cyber hero! 👋
In Module 1, we learned what John the Ripper is and why it is useful. We talked about passwords, hashes, and attacks. Now it is time to do something real!
In this module, we will install John the Ripper on our computer. Then we will run our very first password test. Do not worry – we will go step by step, like building a Lego set. 🧱
By the end of this module, you will have John working on your computer and you will see it crack a test password. That will be so exciting!
After this module, you will be able to:
Remember Kofi from Module 1? He helped Grandma Ada open her treasure chest. Now, Kofi wants to become a master key-maker. He buys a brand new workshop with tools: hammers, files, and a special machine that can copy keys.
But first, he needs to set up the workshop. He unpacks the machine, plugs it in, and reads the manual. Then he tests it with a simple key. The machine works perfectly!
John the Ripper is like that machine. Before we can use it, we need to install it on our computer. Then we test it with a simple password to make sure everything works. That is what this module is all about.
Let’s set up our John workshop! 🔧
Definition: Installation means copying a program to your computer so you can use it.
Why it is important: Without installation, John is just a file that does nothing.
Simple explanation: It is like putting a game CD into your console and waiting for it to load.
Real‑life example: Installing a game like Minecraft on your tablet.
School example: Installing educational software on the school computer.
Home example: Installing a new app on your parent’s phone.
Nigerian example: Installing a banking app like Opay on your phone.
Illustration (ASCII):
💿 John Installer
|
v
📁 Copy files to computer
|
v
✅ John is ready to use!
Mini summary: Installation puts John on your computer.
Definition: Download means getting a file from the internet.
Why it is important: We must download from the official website to avoid viruses.
Simple explanation: Only take candy from a trusted shop, not from a stranger.
Real‑life example: Downloading the Chrome browser from Google.
School example: Downloading a textbook PDF from the school portal.
Home example: Downloading a movie from a safe service like Netflix.
Nigerian example: Downloading the NIBSS app from the official app store.
Illustration (ASCII):
🌐 Internet
|
v
🔗 Official website: openwall.com/john
|
v
⬇️ Download the right version
|
v
📁 Save the file on your computer
Mini summary: Always download John from openwall.com/john.
Definition: Windows is a popular operating system made by Microsoft.
Why it is important: Many people use Windows, so we need to know how to install John on it.
Simple explanation: Windows is like the “brain” of your computer.
Real‑life example: Most laptops in offices run Windows.
School example: Your school lab may have Windows computers.
Home example: Your family desktop might use Windows.
Nigerian example: Many cybercafes in Lagos use Windows.
Illustration (ASCII):
🪟 Windows PC
|
v
📥 Download john.exe
|
v
🖱️ Double‑click to install
|
v
✅ John is ready in C:\john
Mini summary: On Windows, you download an .exe file and run it.
Definition: Linux is a free operating system used by many tech people.
Why it is important: John works very well on Linux.
Simple explanation: Linux is like a different kind of brain for your computer.
Real‑life example: Many servers (big computers) run Linux.
School example: Some university labs use Linux.
Home example: Some tech‑savvy parents use Linux.
Nigerian example: Some Nigerian startups use Linux for their servers.
Illustration (ASCII):
🐧 Linux PC
|
v
📥 Download tar.gz file
|
v
⌨️ Use terminal commands
|
v
✅ John is ready in /usr/bin/john
Mini summary: On Linux, you use the terminal to install John.
Definition: Mac is an operating system made by Apple.
Why it is important: Many people use Macs, so we need to know how to install John there.
Simple explanation: Mac is the brain of Apple computers.
Real‑life example: Many graphic designers use Mac.
School example: Some schools have Mac labs.
Home example: Your friend might have a MacBook.
Nigerian example: Some Nigerian entrepreneurs use MacBooks.
Illustration (ASCII):
🍏 Mac
|
v
📥 Download the Mac version
|
v
⌨️ Use terminal (it is called Terminal)
|
v
✅ John is ready
Mini summary: On Mac, you also use the terminal.
Definition: A terminal is a window where you type commands to talk to the computer.
Why it is important: We need the terminal to run John.
Simple explanation: It is like a chat window with your computer.
Real‑life example: A pilot uses a microphone to talk to the control tower – the terminal is our microphone.
School example: Your teacher uses the command line to install software.
Home example: Your parent might use the terminal to fix a problem.
Nigerian example: A bank IT staff uses the terminal to manage servers.
Illustration (ASCII):
💻 Computer
|
v
🖥️ Terminal window (black screen with text)
+-----------------------------------+
| $ _ |
| |
+-----------------------------------+
Mini summary: The terminal is a text‑based way to control your computer.
Definition: Opening the terminal means launching the command window.
Why it is important: We cannot use John without the terminal.
Simple explanation: It’s like opening the door to the engine room.
Real‑life example: A car mechanic opens the bonnet to see the engine.
School example: You open the terminal to run a Python program.
Home example: You open it to check your Wi‑Fi settings.
Nigerian example: A technician opens the terminal to configure a router.
Illustration (ASCII):
🖥️ Windows: press Win + R, type "cmd"
🍏 Mac: press Cmd + Space, type "terminal"
🐧 Linux: press Ctrl + Alt + T
Mini summary: Every operating system has a way to open the terminal.
Definition: Navigating means moving between folders (directories) using commands.
Why it is important: We need to go to the folder where John is installed.
Simple explanation: Like walking through a building from room to room.
Real‑life example: You go to the kitchen to get a drink.
School example: You move from the classroom to the library.
Home example: You go to your room to get your backpack.
Nigerian example: You move from one shop to another in a market.
Illustration (ASCII):
📁 C:/
|
v
📁 john
|
v
📁 run
|
v
📄 john.exe
Mini summary: Use cd (change directory) to move around.
Definition: The john command is what we type to start the program.
Why it is important: This is the main way we use John.
Simple explanation: It’s like saying “John, start working!”
Real‑life example: You say “Alexa, play music.”
School example: You type “python” to start Python.
Home example: You say “OK Google, set a timer.”
Nigerian example: You type “java” to run a Java program.
Illustration (ASCII):
$ john --wordlist=wordlist.txt hashfile.txt
⬆️ ⬆️ ⬆️ ⬆️
| | | └─ target hash file
| | └─ wordlist to use
| └─ option
└─ command name
Mini summary: The john command is the way we tell John what to do.
Definition: A test hash is a fake hash we create to test John.
Why it is important: We use test hashes to learn without breaking real passwords.
Simple explanation: It’s like a practice exam before the real test.
Real‑life example: A pilot uses a flight simulator.
School example: You solve practice math problems.
Home example: You cook a small meal before making a big dinner.
Nigerian example: A tailor makes a sample before sewing your outfit.
Illustration (ASCII):
Password: “letmein”
|
v
🔐 Hash it
|
v
Hash: 7c6a180b36896a0a8c02787eeafb0e4c
Save this hash in a file called test.hash
Mini summary: Test hashes let us practise safely.
Definition: Running John means executing the program with a hash and a wordlist.
Why it is important: This is the moment we see John in action!
Simple explanation: Like starting a race car for the first time.
Real‑life example: You press the “start” button on a video game.
School example: You run a science experiment.
Home example: You start the washing machine.
Nigerian example: You start a generator.
Illustration (ASCII):
$ john --wordlist=rockyou.txt test.hash
🚀 John starts ...
Trying password: 123456
Trying password: password
Trying password: letmein
✅ Found: letmein
Mini summary: Running John is exciting – it will show us the password!
Definition: Output is what John shows on the screen.
Why it is important: The output tells us if John cracked the password.
Simple explanation: It’s like the result of a test.
Real‑life example: The score at the end of a game.
School example: The grade on your assignment.
Home example: The timer beeping when food is ready.
Nigerian example: The receipt you get after buying something.
Illustration (ASCII):
Output example:
+----------------------------------------+
| john --wordlist=wordlist.txt test.hash |
| Loaded 1 password hash |
| Press 'q' or Ctrl-C to abort |
| 0g 0:00:00:01 0.00% |
| letmein (user) |
| 1g 0:00:00:02 100% |
| Session completed |
+----------------------------------------+
Mini summary: John tells us the password if it finds it.
Definition: Stopping John means ending the program before it finishes.
Why it is important: Sometimes John takes too long, so we stop it.
Simple explanation: Like pausing a movie.
Real‑life example: You turn off a game when you need to do homework.
School example: You stop the timer during a test.
Home example: You turn off the TV.
Nigerian example: You turn off the generator when the power comes.
Illustration (ASCII):
To stop John:
Press Ctrl + C (hold Control and press C)
John will stop and show a summary.
Mini summary: Press Ctrl+C to stop John anytime.
Definition: Saving results means writing the cracked passwords to a file.
Why it is important: We might need the results later.
Simple explanation: Like writing notes in a notebook.
Real‑life example: You save a game progress.
School example: You save your essay.
Home example: You save a recipe.
Nigerian example: You save a transaction receipt.
Illustration (ASCII):
$ john --wordlist=wordlist.txt test.hash --format=raw-md5
$ john --show test.hash
user:letmein
1 password hash cracked, 0 left
Mini summary: Use --show to see saved results.
Definition: Cracking means finding a password from its hash.
Why it is important: It is the goal of using John.
Simple explanation: Like solving a puzzle!
Real‑life example: Winning a game.
School example: Answering a difficult question.
Home example: Finding a lost toy.
Nigerian example: Finding the right key to your gate.
Illustration (ASCII):
🎉🎉🎉 CONGRATULATIONS! 🎉🎉🎉
You cracked your first password!
Password was: letmein
You are now a real John user!
Mini summary: Cracking a password is a big achievement!
john command to run the program.cd to go to the folder.john --wordlist=wordlist.txt test.hash.john --show test.hash.Illustration (flowchart):
Start
|
v
Download John
|
v
Extract files
|
v
Open terminal
|
v
cd to John folder
|
v
Create test.hash
|
v
Run john command
|
v
John tries passwords
|
v
Password found? ── Yes ──> Show result ✅
| |
| No |
v v
John continues End (Success)
|
v
(Eventually stops)
john command with a wordlist and a hash file.john, not “jhon”.--wordlist=.
1. Download → 2. Extract → 3. Open terminal → 4. Run john
(5 mins) (1 min) (30 sec) (varies)
| Operating System | Download File | Installation Method | Terminal |
|---|---|---|---|
| Windows | .exe or .zip | Run .exe or extract .zip | Command Prompt (cmd) |
| Linux | .tar.gz | Extract and compile | Terminal (Ctrl+Alt+T) |
| Mac | .dmg or .tar.gz | Extract and run | Terminal (Cmd+Space) |
+-------------------+
| Start |
+-------------------+
|
v
+-------------------+
| Load hash file |
+-------------------+
|
v
+-------------------+
| Choose wordlist |
+-------------------+
|
v
+-------------------+
| Apply rules |
+-------------------+
|
v
+-------------------+
| Hash each guess |
+-------------------+
|
v
+-------------------+
| Compare hashes |
+-------------------+
|
v
+-----------+--------+
| Match? | |
+-----------+--------+
| Yes | No
v v
+-----------+ +-----------+
| Password | | Next word |
| found! ✅ | | |
+-----------+ +-----------+
| Option | What it does |
|---|---|
| --wordlist=file | Uses a dictionary file |
| --format=type | Specifies hash type (e.g., raw-md5) |
| --show | Shows cracked passwords |
| --session=name | Saves progress under a name |
| --restore=name | Restores a saved session |
Great job! You have completed the second module of the Certified John Ripper User course. Let’s recap:
You now have John installed and working. You are ready for the next step: cracking more complex passwords and using advanced features!
--wordlist option do?--show option used for?--wordlist option tells John which ________ to use.john --________ to see cracked passwords.--wordlist option is optional. (False – it is needed for dictionary attack)--show. (True)--wordlist specify?--show do?Match the term on the left with its description on the right.
| Term | Description |
|---|---|
| 1. Installation | A. A window for text commands |
| 2. Terminal | B. Putting a program on a computer |
| 3. john | C. A list of passwords |
| 4. Wordlist | D. The command to run John |
| 5. test.hash | E. A file with a practice hash |
Answers: 1‑B, 2‑A, 3‑D, 4‑C, 5‑E
--show option do?Scenario 1: Kofi has downloaded John from the official website. He extracts the files but cannot find the john command.
cd.)dir on Windows, ls on Linux/Mac)Scenario 2: Ada runs John with a wordlist but it takes a very long time. She wants to stop it.
--restore)Activity: In groups, each member installs John on their own computer (or a lab computer). Then, everyone runs the same test hash and shares the results. Discuss any differences.
Activity: Create a test hash with the password “johntest” and crack it using John. Write down the command you used and the output.
Project: Create a simple “cracking log” with the following:
Assignment: Install John on your computer. Then, create a test hash with the password “mypassword”. Crack it using John and submit a screenshot of the terminal showing the success.
Challenge: Create a test hash with a password that is not in the rockyou.txt wordlist. Then, try to crack it using John with incremental mode (brute‑force). See how long it takes. (Hint: use --incremental)
(Answers to Fill-in-the-Blank, True/False, and Multiple Choice are provided within each section.)
--show.In Module 3, we will dive deeper into wordlists and rules. We will learn how to create custom wordlists, understand rule syntax, and make John even more powerful. We will also explore different hash formats.
Make sure you have John installed and ready. Bring a curious mind and your notebook. See you in Module 3! 🚀
End of Module 2
Hello again, champion! 👋
In Module 2, we installed John and ran our first test. We saw John crack a simple password using a wordlist. But what if the password is not in the wordlist? What if it is “password1” or “P@ssw0rd”?
That is where rules come in! Rules are like magic tricks that John uses to change words. For example, if John knows “password”, rules can turn it into “Password”, “password1”, or “P@ssw0rd”.
In this module, we will learn how to create our own wordlists and use rules to make John super smart. We will also learn about different hash types and how to tell John which one we are using.
Let’s make John a genius! 🧠✨
After this module, you will be able to:
--format option correctly.Kofi is now a great key‑maker. But he wants to be even better. He meets a wise chef named Mama Nkechi. She can cook any dish with just a few ingredients. How? She uses rules! She adds salt, pepper, or spices to change the taste.
Kofi realises: John can do the same! Instead of just using a list of words, John can change them – add numbers, change letters to symbols, or make them uppercase.
Kofi also learns that different locks need different keys. Some locks are like MD5, others are like SHA‑256. John needs to know which lock he is opening.
Now Kofi can open almost any chest! Let’s learn how John does this. 🍲🔑
Definition: A wordlist is a text file that contains many possible passwords, one per line.
Why it is important: John uses wordlists to guess passwords quickly.
Simple explanation: It is like a big dictionary of words John tries.
Real‑life example: A spelling bee contestant studies a list of words.
School example: Your teacher gives you a list of vocabulary words.
Home example: Your parent has a grocery list.
Nigerian example: A market trader has a list of items to buy.
Illustration (ASCII):
wordlist.txt
+-------------+
| abuja |
| lagos |
| naija |
| chidi |
| bola |
+-------------+
Mini summary: A wordlist is a list of guesses for John.
Definition: Making your own wordlist means creating a file with passwords you choose.
Why it is important: You can target specific passwords (e.g., Nigerian names).
Simple explanation: Like writing your own shopping list.
Real‑life example: You make a list of your friends’ names.
School example: You create a list of classmate names.
Home example: You list your family members’ names.
Nigerian example: You list common Nigerian names: Chidi, Ada, Bola, Tunde.
Illustration (ASCII):
Step 1: Open Notepad
Step 2: Type each password on a new line
Step 3: Save as "mylist.txt"
Example:
Chidi
Ada
Lagos
Nigeria
Mini summary: You can create a wordlist with any text editor.
Definition: Rules are instructions that modify words to create new guesses.
Why it is important: Rules make John much smarter by trying many variations.
Simple explanation: It is like adding toppings to a pizza to make different flavours.
Real‑life example: You take a plain t‑shirt and add a logo.
School example: You take a basic sentence and add adjectives.
Home example: You take a basic recipe and add spices.
Nigerian example: You take jollof rice and add different meats.
Illustration (ASCII):
Base word: "chidi"
Rules:
+ add 1 → "chidi1"
+ uppercase → "Chidi"
+ substitute i→! → "ch!d!"
+ add 2024 → "chidi2024"
Mini summary: Rules change words into many new passwords.
Definition: John comes with default rules that are ready to use.
Why it is important: You can use them without writing your own.
Simple explanation: It is like having a pre‑set recipe book.
Real‑life example: A smartphone has pre‑set camera filters.
School example: Your teacher gives you a template for an essay.
Home example: Your TV has pre‑set picture modes.
Nigerian example: A bank has pre‑set account types.
Illustration (ASCII):
To use rules:
$ john --wordlist=mylist.txt --rules test.hash
John will now apply default rules.
Mini summary: Use --rules to activate John’s built‑in rules.
Definition: Custom rules are rules you write yourself to suit your needs.
Why it is important: You can target specific patterns.
Simple explanation: Like creating your own pizza recipe.
Real‑life example: You create a custom playlist.
School example: You write your own study guide.
Home example: You create a custom cleaning schedule.
Nigerian example: You create a custom menu for a party.
Illustration (ASCII):
Rule syntax example:
$ john --wordlist=mylist.txt --rules=myrules test.hash
In the john.conf file:
[List.Rules:myrules]
$1 # add 1 at the end
u # uppercase all letters
c # capitalize first letter
s?l?l # substitute l with !
Mini summary: You can write custom rules in john.conf.
Definition: Operations are actions rules can perform, like adding, deleting, or changing characters.
Why it is important: They allow endless variations.
Simple explanation: Like having different tools in a toolbox.
Real‑life example: A chef uses a knife, a pan, and a spoon.
School example: You use a pen, ruler, and eraser.
Home example: You use a broom, dustpan, and mop.
Nigerian example: A trader uses a scale, calculator, and bag.
Illustration (ASCII):
Rule operations:
l : lowercase all letters
u : uppercase all letters
c : capitalize first letter
r : reverse the word
d : duplicate the word
$X : append X (e.g., $1 adds 1)
^X : prepend X (e.g., ^A adds A at start)
sXY : substitute X with Y
Mini summary: Rules have many operations to change words.
Definition: Combining wordlists and rules means John tries every word in the wordlist and every variation from the rules.
Why it is important: This gives the best chance of cracking passwords.
Simple explanation: Like having a huge menu with many options.
Real‑life example: A restaurant has a menu and specials.
School example: You have a textbook and notes.
Home example: You have a pantry and recipes.
Nigerian example: A market has a list of goods and special offers.
Illustration (ASCII):
Wordlist: [chidi, bola, ade]
Rules: add 1, uppercase, substitute i→!
John tries:
chidi, Chidi, chidi1, ch!d!, Ch!d!1, ...
bola, Bola, bola1, b0la, ...
ade, Ade, ade1, ...
Mini summary: Rules multiply the number of guesses John makes.
Definition: MD5 is a common hash format that produces a 32‑character hash.
Why it is important: Many systems use MD5, so John needs to recognise it.
Simple explanation: It is like a lock that has a specific keyhole shape.
Real‑life example: A car key has a specific shape.
School example: Your student ID has a specific format.
Home example: Your house key has a specific cut.
Nigerian example: Your BVN has a specific format.
Illustration (ASCII):
Password: "hello"
MD5 hash: 5d41402abc4b2a76b9719d911017c592
(32 characters)
Mini summary: MD5 is a 32‑character hash format.
Definition: SHA‑256 is a more secure hash that produces a 64‑character hash.
Why it is important: It is stronger than MD5 and used in modern systems.
Simple explanation: A stronger lock with a more complex keyhole.
Real‑life example: A high‑security safe.
School example: A school vault for important documents.
Home example: A safe for valuables.
Nigerian example: A bank vault.
Illustration (ASCII):
Password: "hello"
SHA-256 hash: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
(64 characters)
Mini summary: SHA‑256 is a 64‑character hash format.
Definition: The --format option tells John what type of hash it is.
Why it is important: John needs to know the format to crack it correctly.
Simple explanation: Like telling a locksmith what type of lock you have.
Real‑life example: You tell the mechanic your car model.
School example: You tell the teacher which subject.
Home example: You tell the plumber what is broken.
Nigerian example: You tell the electrician the appliance type.
Illustration (ASCII):
$ john --format=raw-md5 test.hash
$ john --format=raw-sha256 test.hash
$ john --format=nt test.hash # for Windows hashes
Mini summary: Use --format to specify the hash type.
Definition: There are many hash types like MD5, SHA‑1, SHA‑256, NT, and LM.
Why it is important: Different systems use different hashes.
Simple explanation: Different locks need different keys.
Real‑life example: Your house, car, and locker all have different keys.
School example: Your locker, bike, and computer all have different passwords.
Home example: Your front door, garage, and safe have different locks.
Nigerian example: Your bank card, phone, and email have different PINs.
Illustration (ASCII):
Hash formats:
+----------+------------------+------------------+
| Format | Length | Example |
+----------+------------------+------------------+
| MD5 | 32 chars | 5d41402abc... |
| SHA‑1 | 40 chars | aaf4c61ddc... |
| SHA‑256 | 64 chars | 2cf24dba5f... |
| NT | 32 chars (hex) | 8846f7ea... |
| LM | 32 chars (hex) | f0e4c2f7... |
+----------+------------------+------------------+
Mini summary: John supports many hash formats.
Definition: Using all three together gives the best chance of cracking.
Why it is important: This is the most powerful way to use John.
Simple explanation: Like using all the best tools at once.
Real‑life example: A chef uses the best ingredients, recipe, and cooking method.
School example: You study with a textbook, notes, and practice questions.
Home example: You clean with a broom, mop, and cleaning spray.
Nigerian example: A farmer uses good seeds, fertiliser, and water.
Illustration (ASCII):
$ john --wordlist=mylist.txt --rules --format=raw-md5 test.hash
This tells John:
1. Use the wordlist mylist.txt
2. Apply rules
3. The hash is MD5
Mini summary: Combine options for maximum power.
Definition: Rules can turn “password” into many variations.
Why it is important: This cracks passwords that are not in the wordlist.
Simple explanation: Rules make John a magician.
Real‑life example: A magician makes one coin into many.
School example: A teacher explains one topic in many ways.
Home example: You use one ingredient in many dishes.
Nigerian example: A tailor uses one fabric for many styles.
Illustration (ASCII):
Base: “lagos”
Rules:
+ uppercase → “LAGOS”
+ capitalize → “Lagos”
+ add 2024 → “lagos2024”
+ substitute a→@ → “l@gos”
+ reverse → “sogal”
John tries all of these!
Mini summary: Rules create many guesses from one word.
Definition: Wordlist etiquette means using wordlists respectfully and legally.
Why it is important: Some wordlists come from data breaches – using them ethically is important.
Simple explanation: Like respecting others’ property.
Real‑life example: You do not use someone’s toothbrush.
School example: You do not copy someone’s homework.
Home example: You do not read someone’s diary.
Nigerian example: You do not use someone’s phone without permission.
Illustration (ASCII):
Do:
+ Use public wordlists
+ Create your own
+ Use for learning
Don't:
- Use leaked passwords
- Use without permission
- Use to hack people
Mini summary: Use wordlists ethically and legally.
Definition: A wordlist master knows how to create, use, and optimise wordlists.
Why it is important: This skill makes you a better John user.
Simple explanation: Like becoming a master chef.
Real‑life example: A master carpenter knows all tools.
School example: A top student knows all subjects.
Home example: A parent who can fix anything.
Nigerian example: A master tailor who can make any outfit.
Illustration (ASCII):
Wordlist Master:
+ Knows how to create custom lists
+ Understands rules
+ Knows hash formats
+ Uses John efficiently
+ Always acts ethically
Mini summary: You are becoming a wordlist master!
--format to tell John the hash type.mylist.txt.test.hash.john --wordlist=mylist.txt test.hash.john --wordlist=mylist.txt --rules test.hash.john --format=raw-md5 --wordlist=mylist.txt --rules test.hash.john --show test.hash.Illustration (flowchart):
Start
|
v
Create wordlist (mylist.txt)
|
v
Save hash (test.hash)
|
v
Run John with wordlist
|
v
Add rules
|
v
Specify format
|
v
Show results
|
v
End
--rules.--rules to activate rules.--format.--rules. --rules when you want variations.--format correctly.
1991 ── MD5 introduced
1995 ── SHA‑1 introduced
2001 ── SHA‑256 introduced
2005 ── NT/LM hashes used in Windows
2024 ── John supports 30+ formats
| Feature | MD5 | SHA‑256 |
|---|---|---|
| Length | 32 characters | 64 characters |
| Security | Weak (can be cracked quickly) | Strong (much harder to crack) |
| Speed | Fast | Slower |
| Common use | Older systems, checksums | Modern systems, security |
Start
|
v
Load wordlist
|
v
For each word:
|
+---> Apply rules
| |
+---> Generate variations
| |
+---> Hash each variation
| |
+---> Compare to target
| |
+---> Match? ── Yes ──> Password found!
| |
+---> No ──> Next word
|
v
End
| Operation | Description | Example |
|---|---|---|
| l | Lowercase all letters | HELLO → hello |
| u | Uppercase all letters | hello → HELLO |
| c | Capitalize first letter | hello → Hello |
| r | Reverse the word | hello → olleh |
| $X | Append X | hello + 1 → hello1 |
| ^X | Prepend X | hello ← A → Ahello |
| sXY | Substitute X with Y | hello → he11o (s l 1) |
Excellent work! You have completed the third module. Here is what we learned:
--format to specify the hash type.You are now a wordlist and rules expert! In the next module, we will learn about advanced cracking techniques and how to optimise John for speed.
--wordlist=file1,file2.--format option used for?--________ to specify the hash type.$1 ________ a 1 to the word.--rules --rule --apply --format --hash --type u do?$1 do?--rules --rules Match the term on the left with its description on the right.
| Term | Description |
|---|---|
| 1. Wordlist | A. Adds 1 to the end |
| 2. Rule | B. A list of passwords |
| 3. $1 | C. An instruction to change a word |
| 4. MD5 | D. A 64‑character hash |
| 5. SHA‑256 | E. A 32‑character hash |
Answers: 1‑B, 2‑C, 3‑A, 4‑E, 5‑D
Scenario 1: Kofi has a wordlist with “chidi” but the password is “Chidi2024”.
--rules.)Scenario 2: Ada has a hash that looks like 64 characters. She tries to crack it but John fails.
--format=raw-sha256.)Activity: In groups, create a wordlist with 10 Nigerian cities. Then, use John with rules to see how many variations you can generate. Present your results.
Activity: Create a custom wordlist with your name, your pet’s name, and your favourite food. Then, use John with rules to crack a test hash with one of those words.
Project: Create a custom wordlist for a specific target (e.g., your school). Include names, places, and common terms. Then, write a set of rules to crack typical passwords. Test it on a dummy hash.
Assignment: Using a test hash, run John with a wordlist without rules, then with rules. Compare the results and write a short report on the difference.
Challenge: Create a rule that generates “Password2024!” from “password”. Then, use it to crack a test hash. (Hint: you need uppercase, append, and substitute.)
(Answers to Fill-in-the-Blank, True/False, and Multiple Choice are provided within each section.)
In Module 4, we will learn about advanced cracking. We will optimise John for speed, use GPU acceleration, and crack complex hashes like ZIP and PDF passwords. We will also learn about session management and restoring jobs.
Make sure you have your John installation ready. See you in Module 4! 🚀
End of Module 3
Hello, brilliant learner! 👋
You have come a long way! In Module 1, we learned what John is. In Module 2, we installed it. In Module 3, we made it smarter with wordlists and rules. Now it is time to make John faster and more powerful.
In this module, we will learn how to crack complex passwords like ZIP files, PDFs, and even Windows passwords. We will also learn how to use John’s advanced features like session management and GPU acceleration.
Think of this as upgrading your car from a standard engine to a turbocharged one. Let’s go! 🏎️💨
After this module, you will be able to:
Kofi has become the best key-maker in Cyberville. But he faces new challenges. People bring him complex locks – some from cars, some from safes, and some from computers.
Kofi upgrades his workshop. He adds a turbo machine that can try keys much faster. He also adds a memory bank that remembers which keys he has tried. Now he can crack even the toughest locks.
That is exactly what we will do with John. We will add speed, memory, and the ability to crack complex locks like ZIP files and Windows passwords.
Let’s upgrade our John workshop! 🛠️🚀
Definition: A session is a record of John’s work, including which passwords have been tried.
Why it is important: If John is interrupted, you can resume from where you stopped.
Simple explanation: Like saving a video game so you can continue later.
Real‑life example: You save a document so you don’t lose your work.
School example: You save your homework on a USB drive.
Home example: You save a movie to watch later.
Nigerian example: You save a transaction receipt.
Illustration (ASCII):
$ john --session=mycrack hashfile.txt
(John saves progress to mycrack.rec)
(If interrupted, resume with:)
$ john --restore=mycrack
Mini summary: Sessions let you save and resume John’s work.
Definition: The pot file is where John stores cracked passwords.
Why it is important: It prevents John from cracking the same password again.
Simple explanation: Like a notebook where you write down solved puzzles.
Real‑life example: You keep a list of phone numbers.
School example: You keep a glossary of new words.
Home example: You keep a list of your passwords (securely!).
Nigerian example: You keep a list of important dates.
Illustration (ASCII):
john.pot (pot file)
+----------------------------------+
| chidi:5f4dcc3b5aa765d61d832... |
| bola:7c6a180b36896a0a8c... |
| tunde:6d7b3e1b2c3d... |
+----------------------------------+
Mini summary: The pot file remembers cracked passwords.
Definition: Incremental mode is John’s brute‑force mode that tries every possible combination.
Why it is important: It can crack any password, but it is very slow.
Simple explanation: Like trying every key in the world.
Real‑life example: A locksmith trying every key on a giant keyring.
School example: You try every possible answer in a multiple‑choice test.
Home example: You try every possible combination to unlock your phone.
Nigerian example: You try every possible PIN at an ATM.
Illustration (ASCII):
$ john --incremental hashfile.txt
John tries:
a, b, c, ..., aa, ab, ..., aaa, ...
(This can take days or years!)
Mini summary: Incremental mode tries all combinations.
Definition: ZIP files are compressed folders that can be password-protected.
Why it is important: Many people use ZIP passwords, and John can crack them.
Simple explanation: Like a locked briefcase.
Real‑life example: You download a ZIP file with homework.
School example: Your teacher sends you a ZIP with notes.
Home example: You save photos in a ZIP file.
Nigerian example: A company sends files in a ZIP.
Illustration (ASCII):
Step 1: Convert ZIP to hash:
$ zip2john secret.zip > zip.hash
Step 2: Crack with John:
$ john --wordlist=wordlist.txt zip.hash
Mini summary: John can crack ZIP passwords using zip2john.
Definition: PDF files can also be password-protected.
Why it is important: John can crack them to recover lost passwords.
Simple explanation: Like a locked document.
Real‑life example: A confidential report is password-protected.
School example: A teacher sends a PDF with exam answers.
Home example: A bank statement is a PDF.
Nigerian example: A legal document is a PDF.
Illustration (ASCII):
Step 1: Convert PDF to hash:
$ pdf2john secret.pdf > pdf.hash
Step 2: Crack with John:
$ john --wordlist=wordlist.txt pdf.hash
Mini summary: John can crack PDF passwords using pdf2john.
Definition: Windows stores passwords as NT hashes.
Why it is important: Many computers use Windows, so we need to crack these hashes.
Simple explanation: Like a special lock used by Windows.
Real‑life example: Your school computer runs Windows.
School example: The lab computers use Windows.
Home example: Your family PC runs Windows.
Nigerian example: Many offices use Windows.
Illustration (ASCII):
Windows NT hash example:
Password: "hello"
NT hash: 8846f7eaee8fb117ad06bdd830b7586c
(32 characters)
Crack with:
$ john --format=nt --wordlist=wordlist.txt nt.hash
Mini summary: John can crack Windows NT hashes.
Definition: GPU stands for Graphics Processing Unit – it is the part of your computer that handles graphics.
Why it is important: GPUs are very fast at certain calculations, making John much faster.
Simple explanation: Like adding a turbo engine to your car.
Real‑life example: Gamers use GPUs for better graphics.
School example: A school computer with a good GPU.
Home example: Your gaming console has a GPU.
Nigerian example: A video editor uses a GPU.
Illustration (ASCII):
CPU: 100 tries/sec
GPU: 1,000,000 tries/sec
John with GPU is MUCH faster!
(Requires special build of John)
Mini summary: GPUs can make John extremely fast.
Definition: Optimisation means making John run as fast as possible.
Why it is important: Faster cracking saves time.
Simple explanation: Like cleaning your car to make it faster.
Real‑life example: You close unnecessary apps on your phone.
School example: You organise your desk to work faster.
Home example: You clean the kitchen to cook faster.
Nigerian example: A trader organises goods to sell faster.
Illustration (ASCII):
Tips for speed:
+ Use GPU if available
+ Use a smaller wordlist if you know the password pattern
+ Use --format to avoid detection delays
+ Use --session to save progress
+ Use --fork to use multiple CPU cores
Mini summary: Optimisation makes John faster.
Definition: The --fork option uses multiple CPU cores to crack faster.
Why it is important: Modern computers have multiple cores, and John can use them all.
Simple explanation: Like having many workers instead of one.
Real‑life example: A factory with many machines.
School example: Many students working on a project.
Home example: Many family members cleaning the house.
Nigerian example: Many traders in a market.
Illustration (ASCII):
$ john --fork=4 --wordlist=wordlist.txt hashfile.txt
This uses 4 CPU cores to crack faster.
Mini summary: --fork uses multiple CPU cores.
Definition: Linux stores passwords in the /etc/shadow file as hashes.
Why it is important: Many servers run Linux, and we may need to test their security.
Simple explanation: Like the Windows lock, but for Linux.
Real‑life example: A web server runs Linux.
School example: The school server may run Linux.
Home example: A Raspberry Pi runs Linux.
Nigerian example: A bank’s server may run Linux.
Illustration (ASCII):
shadow file example:
user:$6$salt$hash:...
Crack with:
$ john --format=sha512crypt shadow.txt
Mini summary: John can crack Linux shadow hashes.
Definition: RAR files are compressed files that can have passwords.
Why it is important: Some people use RAR instead of ZIP.
Simple explanation: Another type of locked briefcase.
Real‑life example: A friend sends you a RAR file.
School example: Your teacher sends a RAR with notes.
Home example: You download a RAR file.
Nigerian example: A company uses RAR for files.
Illustration (ASCII):
Step 1: Convert RAR to hash:
$ rar2john secret.rar > rar.hash
Step 2: Crack with John:
$ john --wordlist=wordlist.txt rar.hash
Mini summary: John can crack RAR passwords.
Definition: A security audit is a test to find weaknesses.
Why it is important: John helps companies find weak passwords.
Simple explanation: Like a fire drill to test safety.
Real‑life example: A company hires a security team to test their systems.
School example: The school tests its computer lab.
Home example: You test your Wi‑Fi password.
Nigerian example: A bank conducts a security audit.
Illustration (ASCII):
Audit process:
1. Collect hashes
2. Run John with wordlists and rules
3. Analyse results
4. Report weak passwords
5. Recommend improvements
Mini summary: John is a key tool in security audits.
Definition: Ethical considerations are rules about right and wrong.
Why it is important: Advanced cracking can be used for harm, so we must be careful.
Simple explanation: Like having superpowers – use them for good.
Real‑life example: A doctor uses skills to heal, not harm.
School example: You use knowledge to help others.
Home example: You use tools to fix things, not break them.
Nigerian example: You use a car to transport, not to race dangerously.
Illustration (ASCII):
Ethical Use:
+ Always have permission
+ Only crack your own or authorised systems
+ Report vulnerabilities responsibly
+ Never use cracked passwords for harm
Mini summary: Always use advanced cracking ethically.
Definition: Performance tips are ways to make John run better.
Why it is important: They save time and resources.
Simple explanation: Like using the right tool for the job.
Real‑life example: You use a calculator for math.
School example: You use a highlighter for important notes.
Home example: You use a fast kettle for tea.
Nigerian example: You use a generator during a power cut.
Illustration (ASCII):
Performance Tips:
1. Use --format to skip detection
2. Use --fork to use multiple cores
3. Use GPU if available
4. Use a targeted wordlist
5. Use --session to save progress
Mini summary: Performance tips make John faster.
Definition: An advanced user can crack complex passwords and optimise John.
Why it is important: You are now ready for real‑world challenges.
Simple explanation: Like becoming a master chef.
Real‑life example: A senior security analyst.
School example: The top student in the class.
Home example: A parent who can fix anything.
Nigerian example: A master tailor.
Illustration (ASCII):
Advanced John User:
+ Can crack any hash format
+ Uses sessions and pot files
+ Optimises with GPU and forks
+ Cracks ZIP, PDF, RAR, and more
+ Acts ethically
+ Helps others stay secure
Mini summary: You are now an advanced John user!
--fork uses multiple CPU cores.zip2john to extract the hash: zip2john secret.zip > zip.hash.rockyou.txt or a custom list.john --wordlist=rockyou.txt zip.hash.john --wordlist=rockyou.txt --rules zip.hash.john --show zip.hash.Illustration (flowchart):
Start
|
v
Get ZIP file
|
v
zip2john → zip.hash
|
v
Run John with wordlist
|
v
Add rules
|
v
Show results
|
v
End
zip2john.rockyou.txt wordlist is from a 2009 data breach.--fork for multiple cores.zip2john before cracking. --session.--fork and GPU if available.
1996 ── John 1.0 released
2000 ── Added Windows support
2005 ── Added GPU support
2010 ── Added more hash formats
2015 ── Added session management
2024 ── John 1.9 with advanced features
| Mode | Description | Speed | Best for |
|---|---|---|---|
| Wordlist | Uses a dictionary | Fast | Common passwords |
| Rules | Modifies words | Medium | Password variations |
| Incremental | Tries all combinations | Slow | Short passwords |
| GPU | Uses graphics card | Very fast | Large cracking tasks |
Start
|
v
ZIP file (secret.zip)
|
v
zip2john → zip.hash
|
v
Run John with wordlist
|
v
Add rules
|
v
Check results
|
v
Password found? ── Yes ──> Success!
|
No
|
v
Try incremental mode
|
v
End
| File Type | Tool | Format |
|---|---|---|
| ZIP | zip2john | zip |
| pdf2john | ||
| RAR | rar2john | rar |
| Windows | pwdump | nt |
| Linux | unshadow | sha512crypt |
Amazing work! You have completed the fourth module. Here is what we learned:
--fork for multiple cores.You are now an advanced John user! In the next module, we will learn about real‑world penetration testing and how to use John in professional security assessments.
--session=name and --restore=name.--fork?john --fork=4 uses 4 cores.--fork, and optimisation.--________ to use multiple cores.--fork uses multiple cores. (True)--session --save --store zip2john pdf2john rar2john --fork --cores --multi rar2john zip2john pdf2john --restore --resume --continue Match the term on the left with its description on the right.
| Term | Description |
|---|---|
| 1. Session | A. Stores cracked passwords |
| 2. Pot file | B. Saved state of John's work |
| 3. Incremental | C. Used for ZIP files |
| 4. zip2john | D. Brute‑force mode |
| 5. GPU | E. Makes John faster |
Answers: 1‑B, 2‑A, 3‑D, 4‑C, 5‑E
Scenario 1: Kofi has a ZIP file called “secret.zip” that he forgot the password to.
zip2john and then John.)Scenario 2: Ada is running John on a large hash file and it is taking too long.
--fork or GPU.)--session.)Activity: In groups, create a password‑protected ZIP file and then use John to crack it. Share your results and discuss the time taken.
Activity: Create a PDF with a password and crack it using John. Write down the steps you took.
Project: Create a report on how to crack a ZIP file using John. Include the steps, commands, and screenshots (if possible). Also, include a section on ethical considerations.
Assignment: Using John, crack a password‑protected ZIP file provided by your teacher. Submit a report with the password and the time taken.
Challenge: Crack a PDF password that is not in any wordlist. Use incremental mode and time how long it takes. (Hint: use a short password.)
(Answers to Fill-in-the-Blank, True/False, and Multiple Choice are provided within each section.)
--fork significantly improve speed.In Module 5, we will learn about real‑world penetration testing. We will simulate a real security audit, use John in a team, and understand how professionals use John to protect organisations.
Make sure you have John installed and have completed all exercises. See you in Module 5! 🚀
End of Module 4
Hello, future cyber guardian! 👋
You have learned so much! You know how to install John, create wordlists, use rules, crack ZIP files, and even use GPU acceleration. Now it is time to put all those skills together in a real‑world scenario.
In this module, we will learn about penetration testing – that is when good guys (like you) test computer systems to find weaknesses before bad guys do. We will simulate a real security audit and see how John fits into the bigger picture.
Think of yourself as a superhero who tests the strength of a fortress. You find weak points and help fix them. That is what penetration testers do!
Let’s become cyber superheroes! 🦸♂️🦸♀️
After this module, you will be able to:
Kofi is now a master key-maker. But he wants to do more. He hears about the Cyber Fortress – a big company that keeps everyone’s data safe. The company hires Kofi to test their locks.
Kofi plans his test. He asks for permission. He checks all the doors, windows, and gates. He uses his tools (including John) to see if any locks are weak. He finds a few weak locks and tells the company how to fix them.
The company thanks Kofi and makes their fortress stronger. Kofi feels proud because he helped protect people’s data.
That is exactly what penetration testing is – testing a system to make it stronger.
Let’s learn how to do it! 🏰🔐
Definition: Penetration testing (or pen testing) is when security experts test a system to find vulnerabilities.
Why it is important: It helps organisations fix weaknesses before hackers can exploit them.
Simple explanation: Like a fire drill – you test the system to see if it works.
Real‑life example: A company hires a hacker (ethical) to test their network.
School example: A teacher gives a practice test before the final exam.
Home example: You test your smoke alarm to see if it works.
Nigerian example: A bank tests its online banking system.
Illustration (ASCII):
Penetration Testing Process:
Plan → Recon → Attack → Report → Fix
| | | | |
v v v v v
Get Find Try to Write Improve
OK holes break report security
Mini summary: Pen testing is testing systems to make them safer.
Definition: John is used in pen testing to crack password hashes and test password strength.
Why it is important: Weak passwords are one of the biggest security risks.
Simple explanation: John is the key tester – it checks if the locks are strong.
Real‑life example: A pen tester uses John to test employee passwords.
School example: The IT teacher uses John to check student passwords.
Home example: You use John to test your Wi‑Fi password.
Nigerian example: A bank uses John to test staff passwords.
Illustration (ASCII):
Pen Tester
|
v
John the Ripper
|
v
Finds weak passwords
|
v
Reports to client
|
v
Client fixes weaknesses
Mini summary: John helps pen testers find weak passwords.
Definition: Planning means deciding what to test, how to test it, and when to test it.
Why it is important: Good planning leads to a successful test.
Simple explanation: Like planning a trip – you decide where to go and what to pack.
Real‑life example: A security team plans a test for a client.
School example: You plan a study schedule.
Home example: You plan a weekend activity.
Nigerian example: A trader plans what goods to buy for the market.
Illustration (ASCII):
Planning Steps:
1. Define scope (what to test)
2. Get permission (very important!)
3. Set timeline (when to test)
4. Gather tools (John, wordlists, etc.)
5. Prepare team (who will do what)
Mini summary: Planning is the first step in any pen test.
Definition: Rules of engagement are the guidelines for the test, including what is allowed and what is not.
Why it is important: Without permission, testing is illegal.
Simple explanation: Like asking before entering someone’s house.
Real‑life example: A pen tester signs a contract with the client.
School example: You ask your teacher before using a computer.
Home example: You ask your parent before using their phone.
Nigerian example: A security company signs an agreement with a bank.
Illustration (ASCII):
Permission Contract:
+----------------------------+
| I, [client], give |
| permission to [tester] |
| to test our systems |
| from [date] to [date]. |
| Scope: [what is allowed] |
| Rules: [what is forbidden]|
+----------------------------+
Mini summary: Always get written permission before testing.
Definition: Gathering hashes means collecting password hashes from a system.
Why it is important: John needs hashes to crack passwords.
Simple explanation: Like collecting samples for a lab test.
Real‑life example: A pen tester dumps hashes from a Windows server.
School example: The IT admin collects hashes from school computers.
Home example: You collect hashes from your own devices.
Nigerian example: A bank collects hashes from their staff systems.
Illustration (ASCII):
Hash Gathering:
Windows: pwdump → hashes.txt
Linux: unshadow → hashes.txt
Tools: mimikatz, fgdump, etc.
Always have permission!
Mini summary: Hashes are collected from systems for testing.
Definition: Running John on real hashes means cracking the passwords from a real system.
Why it is important: This is where John shows its power.
Simple explanation: Like testing the real locks.
Real‑life example: A pen tester runs John on client hashes.
School example: A teacher runs John on lab computer hashes.
Home example: You run John on your own hashes.
Nigerian example: A bank runs John on employee hashes.
Illustration (ASCII):
$ john --wordlist=rockyou.txt --rules hashes.txt
John starts cracking...
Loaded 100 hashes.
Press 'q' to quit.
0g 0:00:00:01 0.00%
10g 0:00:01:23 10.00%
...
Results saved in john.pot
Mini summary: John cracks real hashes to find weak passwords.
Definition: Analysing results means looking at John’s output and understanding what it means.
Why it is important: You need to know which passwords are weak.
Simple explanation: Like reading a test score.
Real‑life example: A pen tester examines the cracked passwords.
School example: A teacher checks which students passed.
Home example: You check which locks are weak.
Nigerian example: A bank checks which staff have weak passwords.
Illustration (ASCII):
Results Analysis:
Password: 123456 → very weak
Password: password → very weak
Password: chidi2024 → medium
Password: Lagos123 → medium
Password: P@ssw0rd! → strong
Mini summary: Analysing results helps identify weak passwords.
Definition: A security report documents the findings of a pen test.
Why it is important: Clients need to know what to fix.
Simple explanation: Like a doctor’s report after a check‑up.
Real‑life example: A pen tester writes a report for the client.
School example: You write a report on a science experiment.
Home example: You write a note to your parents about a broken lock.
Nigerian example: A bank receives a report from security experts.
Illustration (ASCII):
Security Report
+----------------------------+
| 1. Executive Summary |
| 2. Scope of Test |
| 3. Methodology |
| 4. Findings |
| 5. Recommendations |
| 6. Appendix |
+----------------------------+
Mini summary: A report communicates findings and recommendations.
Definition: Recommending fixes means suggesting ways to improve security.
Why it is important: It helps the client fix the weaknesses.
Simple explanation: Like telling someone how to repair a broken lock.
Real‑life example: A pen tester recommends password policies.
School example: A teacher recommends students use stronger passwords.
Home example: You recommend your family uses a stronger Wi‑Fi password.
Nigerian example: A bank implements new password policies.
Illustration (ASCII):
Recommendations:
1. Enforce minimum 12‑character passwords
2. Require uppercase, lowercase, numbers, symbols
3. Use multi‑factor authentication (MFA)
4. Change passwords every 90 days
5. Use a password manager
Mini summary: Recommendations help improve security.
Definition: A pen testing team is a group of security experts who work together.
Why it is important: Teamwork makes testing more effective.
Simple explanation: Like a football team – everyone has a role.
Real‑life example: A company hires a team of pen testers.
School example: Students work on a group project.
Home example: Family members work together to clean the house.
Nigerian example: A security firm has a team for each client.
Illustration (ASCII):
Pen Testing Team Roles:
+------------------+
| Team Leader | → Plans and manages
| Network Tester | → Tests network
| Web Tester | → Tests web apps
| Password Tester | → Uses John
| Report Writer | → Writes findings
+------------------+
Mini summary: Teams make pen testing more effective.
Definition: A real audit is a simulated exercise that mimics a real pen test.
Why it is important: It prepares you for real‑world challenges.
Simple explanation: Like a fire drill – it prepares you for a real fire.
Real‑life example: A company runs a mock pen test.
School example: Your teacher gives a mock exam.
Home example: You practice a fire drill at home.
Nigerian example: A bank conducts a simulated security test.
Illustration (ASCII):
Simulated Audit:
1. Set up a test environment
2. Create dummy user accounts
3. Run John on dummy hashes
4. Write a report
5. Present findings to the “client”
Mini summary: Simulated audits are great for learning.
Definition: Ethical hacking is using hacking skills for good – to protect people and systems.
Why it is important: Ethical hackers are the heroes of the digital world.
Simple explanation: Like a police officer who uses a gun to protect, not to harm.
Real‑life example: A certified ethical hacker (CEH) works for a security company.
School example: A student uses their skills to help classmates.
Home example: A parent uses technology to keep the family safe.
Nigerian example: A Nigerian cybersecurity professional helps banks.
Illustration (ASCII):
Ethical Hacker:
+ Protects people
+ Finds vulnerabilities
+ Reports responsibly
+ Never harms others
+ Helps make the internet safer
Mini summary: Ethical hacking is about helping and protecting.
Definition: Real pen test examples are case studies of actual pen tests.
Why it is important: They show how pen testing works in practice.
Simple explanation: Like reading a story about a real adventure.
Real‑life example: A pen test reveals weak passwords in a company.
School example: A school discovers that students use easy passwords.
Home example: A family discovers their Wi‑Fi password is weak.
Nigerian example: A bank finds that staff use common passwords.
Illustration (ASCII):
Case Study: XYZ Bank
1. Hashes collected from 100 staff
2. John ran with rockyou.txt and rules
3. 45 hashes cracked in 1 hour
4. 25 passwords were "password" or "123456"
5. Recommendations: enforce stronger passwords
6. Bank implements new policy
Mini summary: Real examples show the importance of pen testing.
Definition: The future of pen testing includes AI, machine learning, and automated tools.
Why it is important: Technology is always changing, and pen testers must keep up.
Simple explanation: Like upgrading your phone to a newer model.
Real‑life example: AI is used to predict and find vulnerabilities.
School example: Students learn about new cybersecurity trends.
Home example: Smart home devices need security testing.
Nigerian example: Nigerian companies adopt AI for security.
Illustration (ASCII):
Future of Pen Testing:
+ AI-powered tools
+ Automated vulnerability scanning
+ Cloud security testing
+ IoT (Internet of Things) testing
+ Continuous security monitoring
Mini summary: The future of pen testing is exciting and ever‑evolving.
Definition: A certified pen tester has passed exams and proven their skills.
Why it is important: Certification shows you are knowledgeable and trustworthy.
Simple explanation: Like a driver’s license – it proves you can drive safely.
Real‑life example: A security professional gets the OSCP certification.
School example: You get a certificate after completing a course.
Home example: You get a merit badge for learning a new skill.
Nigerian example: A Nigerian professional gets CISSP certification.
Illustration (ASCII):
Certification Path:
Learn basics → Practice → Take exam → Get certified → Work in the field
Mini summary: Certification proves you are a skilled pen tester.
Illustration (flowchart):
Start
|
v
Plan (scope, permission)
|
v
Gather hashes
|
v
Run John
|
v
Analyse results
|
v
Write report
|
v
Present to client
|
v
Follow up
|
v
End
Day 1 ── Planning and scope definition
Day 2 ── Gathering hashes and initial reconnaissance
Day 3 ── Cracking with John
Day 4 ── Analysing results
Day 5 ── Writing the report
Day 6 ── Presenting to the client
Day 7 ── Follow‑up and remediation
| Feature | Penetration Test | Vulnerability Scan |
|---|---|---|
| Goal | Exploit vulnerabilities | Identify vulnerabilities |
| Method | Manual and automated | Automated only |
| Result | Proof of exploitation | List of potential issues |
| Cost | Higher | Lower |
| Time | Days to weeks | Hours to days |
Start
|
v
Define Scope
|
v
Get Permission
|
v Gather Information
|
v
Test Systems
|
v
Analyse Results
|
v
Write Report
|
v
Present Findings
|
v
Follow Up
|
v
End
| Role | Responsibility |
|---|---|
| Team Leader | Manages the test, communicates with client |
| Network Tester | Tests network infrastructure |
| Web Tester | Tests web applications |
| Password Tester | Uses John to test password strength |
| Report Writer | Documents findings and recommendations |
Outstanding work! You have completed the fifth module. Here is what we learned:
You are now ready to conduct a real‑world pen test (with permission, of course!). In the next module, we will learn about defensive measures – how to protect against password cracking and other attacks.
Match the term on the left with its description on the right.
| Term | Description |
|---|---|
| 1. Penetration testing | A. A document with findings |
| 2. Permission | B. Testing systems for vulnerabilities |
| 3. Report | C. Must be obtained before testing |
| 4. John | D. A tool for cracking passwords |
| 5. Recommendation | E. A suggestion to fix a weakness |
Answers: 1‑B, 2‑C, 3‑A, 4‑D, 5‑E
Scenario 1: A company hires a pen testing team. The team leader assigns roles. Kofi is responsible for password testing.
Scenario 2: A pen tester finds that 30 out of 100 passwords are weak.
Activity: In groups, plan a simulated pen test for a mock company. Assign roles, create a test plan, and present your plan to the class.
Activity: Imagine you are a pen tester. Write a one‑page security report for a mock company with three weak passwords and three recommendations.
Project: Conduct a simulated pen test on a test system. Use John to crack passwords, write a report, and present your findings.
Assignment: Using a test system provided by your teacher, gather hashes, run John, and write a security report with recommendations.
Challenge: Simulate a pen test on a system with a mix of weak and strong passwords. Use John to crack as many as possible, and then write a detailed report with actionable recommendations.
(Answers to Fill-in-the-Blank, True/False, and Multiple Choice are provided within each section.)
In Module 6, we will learn about defensive measures. We will understand how to protect against password cracking, implement strong password policies, and use tools like John to test our own defences.
Make sure you have your John installation ready. See you in Module 6! 🚀
End of Module 5
Hello, cyber guardian! 👋
You have learned so much about John the Ripper – how it works, how to use it, and even how to crack passwords. But there is another side to the story: defence.
In this module, we will learn how to protect ourselves and others from password cracking. We will understand what makes a password strong, how to implement good password policies, and how to use tools like John to test our own defences.
Think of it like building a fortress. You need strong walls, good locks, and watchful guards. That is what defence is all about.
Let’s become defenders! 🏰🛡️
After this module, you will be able to:
Kofi has helped many people secure their locks. But he realises that even the best locks can be broken if they are weak. He decides to build his own fortress and make it unbreakable.
He starts by using strong materials (like long, complex passwords). He adds multiple locks (multi‑factor authentication). He also tests his own fortress using John to see if there are any weaknesses.
He discovers that some of his locks are weak and replaces them. He also teaches his friends how to build strong fortresses. Now his fortress is safe, and so are his friends'.
That is what this module is about – building strong defences and testing them.
Let’s build our fortress! 🏗️🔒
Definition: A strong password is long, complex, and unique.
Why it is important: It is very hard for John to crack.
Simple explanation: Like having a very long and complicated key.
Real‑life example: A password like “M1ch3al!23#” is strong.
School example: Your teacher tells you to use a password with letters, numbers, and symbols.
Home example: Your Wi‑Fi password should be strong.
Nigerian example: A bank requires a password with at least 12 characters.
Illustration (ASCII):
Weak password: "ade" → John cracks instantly
Strong password: "Adeola@2024!Fun" → John takes years
Mini summary: Strong passwords are long, complex, and unique.
Definition: Password policies are rules that guide how passwords are created and used.
Why it is important: They ensure that everyone uses strong passwords.
Simple explanation: Like school rules – they tell you what to do.
Real‑life example: A company requires passwords to be at least 12 characters long.
School example: Your school requires passwords with numbers and symbols.
Home example: Your family decides to use a password manager.
Nigerian example: A bank enforces a password policy for all staff.
Illustration (ASCII):
Password Policy Example:
+ Minimum 12 characters
+ Must include uppercase, lowercase, number, symbol
+ Must be changed every 90 days
+ Cannot be the same as previous 5 passwords
Mini summary: Password policies enforce strong passwords.
Definition: MFA requires more than one factor to log in – something you know (password), something you have (phone), or something you are (fingerprint).
Why it is important: Even if John cracks your password, the attacker still cannot log in without the second factor.
Simple explanation: Like having two locks on your door instead of one.
Real‑life example: You enter a password and then receive a code on your phone.
School example: You use a student ID card and a PIN.
Home example: You use your phone and a fingerprint.
Nigerian example: A bank sends an OTP (one‑time password) to your phone.
Illustration (ASCII):
MFA Process:
Step 1: Enter password (something you know)
Step 2: Enter code from phone (something you have)
Step 3: Scan fingerprint (something you are)
Access granted!
Mini summary: MFA adds an extra layer of security.
Definition: Salting is adding random data to a password before hashing it.
Why it is important: It makes it much harder for John to crack hashes.
Simple explanation: Like adding a secret spice to a recipe.
Real‑life example: A website adds a random string to each password before hashing.
School example: Your teacher gives each student a different test.
Home example: You add a secret ingredient to your meal.
Nigerian example: A bank uses salting to protect customer passwords.
Illustration (ASCII):
Without salt:
Password: "hello" → Hash: 5d41402abc...
If two users have the same password, they have the same hash.
With salt:
Password: "hello" + Salt: "xyz123" → Hash: 7c6a180b...
Even with the same password, hashes are different!
Mini summary: Salting makes hashes unique and harder to crack.
Definition: Account lockout policies lock an account after too many failed login attempts.
Why it is important: It stops attackers from trying millions of passwords.
Simple explanation: Like a door that locks after too many wrong keys.
Real‑life example: An ATM locks your card after 3 wrong PIN attempts.
School example: The school computer locks after 5 wrong password attempts.
Home example: Your phone locks after 10 wrong attempts.
Nigerian example: A bank locks your online account after 3 wrong attempts.
Illustration (ASCII):
Account Lockout Policy:
3 failed attempts → Account locked for 30 minutes
5 failed attempts → Account locked for 1 hour
10 failed attempts → Account locked permanently (admin must unlock)
Mini summary: Lockout policies stop brute‑force attacks.
Definition: A password manager is a tool that stores and generates strong passwords.
Why it is important: It helps you use different strong passwords for every account.
Simple explanation: Like a digital safe for your passwords.
Real‑life example: You use a password manager like LastPass or Bitwarden.
School example: Your teacher recommends a password manager.
Home example: Your family uses a password manager to store all passwords.
Nigerian example: A company provides password managers to employees.
Illustration (ASCII):
Password Manager:
+ Stores all your passwords in one place
+ Generates strong, random passwords
+ You only need to remember one master password
+ Syncs across all your devices
Mini summary: Password managers make strong passwords easy.
Definition: You can use John on your own hashes to test how strong your passwords are.
Why it is important: It helps you find weaknesses before attackers do.
Simple explanation: Like testing your own locks.
Real‑life example: A company uses John to audit employee passwords.
School example: A teacher uses John to test student passwords.
Home example: You use John to test your Wi‑Fi password.
Nigerian example: A bank uses John to test staff passwords.
Illustration (ASCII):
Testing Your Own Defences:
1. Collect your own hashes (with permission)
2. Run John with wordlists and rules
3. See which passwords are cracked
4. Change weak passwords immediately
Mini summary: Use John to test and improve your own passwords.
Definition: Education means teaching people how to create and manage strong passwords.
Why it is important: Security is only as strong as the weakest link – and that is often people.
Simple explanation: Like teaching someone how to lock their door.
Real‑life example: A company trains employees on password security.
School example: Your teacher gives a lesson on password safety.
Home example: You teach your parents about strong passwords.
Nigerian example: A bank runs a security awareness campaign.
Illustration (ASCII):
Security Awareness Campaign:
+ Posters about strong passwords
+ Workshops on password managers
+ Quizzes to test knowledge
+ Regular reminders to change passwords
Mini summary: Educating others is key to improving security.
Definition: Encryption scrambles data so it can only be read with a key.
Why it is important: Even if John cracks a password, the data is still encrypted.
Simple explanation: Like putting a message in a locked box.
Real‑life example: Websites use HTTPS to encrypt data.
School example: Your school encrypts student records.
Home example: You encrypt your laptop’s hard drive.
Nigerian example: A bank encrypts customer data.
Illustration (ASCII):
Encryption:
Data: "Hello" → Encrypt → "X7h3K9mP2"
Without key → gibberish
With key → "Hello"
Mini summary: Encryption protects data even if passwords are cracked.
Definition: Regular audits mean testing security on a regular basis.
Why it is important: Security threats change over time.
Simple explanation: Like going to the doctor for a check‑up.
Real‑life example: A company does a security audit every quarter.
School example: Your school tests its network every year.
Home example: You test your home security every few months.
Nigerian example: A bank does regular security audits.
Illustration (ASCII):
Regular Audit Schedule:
+ Monthly: Password audits with John
+ Quarterly: Full security assessment
+ Yearly: Independent external audit
Mini summary: Regular audits keep security strong.
Definition: Incident response is the plan for what to do when a security breach occurs.
Why it is important: It helps you respond quickly and effectively.
Simple explanation: Like having a fire drill – you know what to do.
Real‑life example: A company has a plan for data breaches.
School example: A school has a plan for cyber attacks.
Home example: You have a plan for if your phone is stolen.
Nigerian example: A bank has a cyber incident response team.
Illustration (ASCII):
Incident Response Plan:
1. Identify the breach
2. Contain the damage
3. Investigate the cause
4. Fix the vulnerability
5. Notify affected parties
6. Review and improve
Mini summary: Incident response prepares you for security breaches.
Definition: Social engineering is tricking people into giving up passwords.
Why it is important: Even the strongest password can be stolen if someone is tricked.
Simple explanation: Like a con artist tricking you into giving them your keys.
Real‑life example: A hacker calls pretending to be IT support.
School example: Someone pretends to be a teacher to get students’ passwords.
Home example: A scammer calls asking for your bank details.
Nigerian example: A scammer sends a phishing email to bank customers.
Illustration (ASCII):
Social Engineering Prevention:
+ Never give passwords to anyone
+ Verify the identity of callers
+ Don't click on suspicious links
+ Report suspicious activity
+ Use MFA to protect against stolen passwords
Mini summary: People are often the weakest link – educate and protect them.
Definition: Zero Trust means never trust anyone by default – always verify.
Why it is important: It reduces the risk of insider threats and breaches.
Simple explanation: Like always checking ID before letting someone in.
Real‑life example: A company requires MFA for all employees.
School example: A school verifies everyone entering the building.
Home example: You always ask who is at the door before opening it.
Nigerian example: A bank verifies every transaction with OTP.
Illustration (ASCII):
Zero Trust Principles:
1. Verify everyone (even employees)
2. Limit access to only what is needed
3. Assume breach – always be prepared
4. Use MFA everywhere
5. Monitor and audit regularly
Mini summary: Zero Trust makes security stronger.
Definition: Security culture means making security a habit for everyone.
Why it is important: When everyone practices good security, it becomes natural.
Simple explanation: Like brushing your teeth – it becomes a habit.
Real‑life example: A company rewards employees who use strong passwords.
School example: A school teaches cybersecurity as part of the curriculum.
Home example: Your family discusses security at dinner.
Nigerian example: A bank has a security‑first culture.
Illustration (ASCII):
Building a Security Culture:
+ Education and training
+ Reward good security habits
+ Lead by example
+ Make security easy and accessible
+ Encourage reporting of issues
Mini summary: Security culture makes everyone a defender.
Definition: A defender is someone who protects against cyber threats.
Why it is important: You are now a guardian of cybersecurity.
Simple explanation: Like a superhero who protects the digital world.
Real‑life example: You work as a security analyst.
School example: You help your school improve security.
Home example: You help your family stay safe online.
Nigerian example: You help Nigerian businesses stay secure.
Illustration (ASCII):
You are a Defender!
+ Know how to use John for good
+ Understand strong passwords
+ Promote security awareness
+ Test and improve defences
+ Protect people and data
Mini summary: You are now a defender of cybersecurity!
Illustration (flowchart):
Start
|
v
Collect hashes
|
v
Run John
|
v
Analyse results
|
v
Change weak passwords
|
v
Implement policies
|
v
Educate others
|
v
Repeat regularly
|
v
End
1970s ── First passwords used
1980s ── Account lockout introduced
1990s ── Salting invented
2000s ── Password policies become common
2010s ── MFA becomes popular
2020s ── Password managers and Zero Trust
| Feature | Weak Password | Strong Password |
|---|---|---|
| Length | Short (<8 characters) | Long (≥12 characters) |
| Complexity | Only letters | Letters, numbers, symbols |
| Uniqueness | Used for many accounts | Unique for each account |
| Crack time | Seconds to minutes | Years to centuries |
Start
|
v
Use strong passwords
|
v
Enable MFA
|
v
Use salting
|
v
Implement lockout
|
v
Use password manager
|
v
Test with John
|
v
Educate others
|
v
End
| Tool | Purpose | Example |
|---|---|---|
| Password manager | Store and generate passwords | Bitwarden, LastPass |
| MFA app | Generate one‑time codes | Google Authenticator |
| Encryption | Protect data | AES‑256 |
| Audit tool | Test security | John the Ripper |
| Education | Raise awareness | Training sessions |
Fantastic work! You have completed the sixth module. Here is what we learned:
You are now a defender of cybersecurity! In the final module, we will review everything and prepare you for the certification exam.
Match the term on the left with its description on the right.
| Term | Description |
|---|---|
| 1. Strong password | A. Adds random data to a password |
| 2. MFA | B. Long, complex, unique |
| 3. Salting | C. More than one factor to log in |
| 4. Password manager | D. Tool to store passwords |
| 5. Encryption | E. Scrambling data |
Answers: 1‑B, 2‑C, 3‑A, 4‑D, 5‑E
Scenario 1: A company has many employees who use weak passwords like “password” and “123456”.
Scenario 2: A bank customer receives a call from someone claiming to be IT support asking for their password.
Activity: In groups, design a security awareness campaign for a mock company. Include posters, tips, and a plan for educating employees about strong passwords.
Activity: Create a list of 10 strong passwords and explain why they are strong. Then, test them with John (if possible) to see how long they would take to crack.
Project: Conduct a password audit for a mock organisation. Use John to test passwords, write a report with findings, and recommend improvements.
Assignment: Using John, test a set of sample passwords provided by your teacher. Write a report on which passwords are weak and how they can be improved.
Challenge: Create a password policy for a Nigerian bank. Include requirements for length, complexity, MFA, and account lockout. Then, test the policy by creating sample passwords and running John on them.
(Answers to Fill-in-the-Blank, True/False, and Multiple Choice are provided within each section.)
In Module 7, we will review everything we have learned. We will also take a practice exam and prepare for the certification exam. You are almost a Certified John Ripper User!
Make sure you have completed all exercises and have a good understanding of all modules. See you in Module 7! 🎓
End of Module 6
Hello, graduating hero! 👋
You have made it to the final module! You have learned everything from installing John to defending against password attacks. Now it is time to review everything and prepare for your certification.
This module is like a big revision session before a final exam. We will go over all the important points from previous modules. We will also do lots of practice questions and exercises.
By the end of this module, you will be ready to take the Certified John Ripper User exam and become a certified expert!
Let’s review and prepare! 📚💪
After this module, you will be able to:
Kofi has learned everything about locks and keys. He has helped many people and built strong fortresses. Now it is time for his final test – the Grand Master Key‑Maker Exam.
He reviews all his notes, practises with his tools, and helps his friends prepare too. On the exam day, he is calm and confident. He answers every question and completes every task.
At the end, he is awarded the title of Grand Master Key‑Maker. He is proud and ready to help even more people.
That is exactly where you are now – at the final step before becoming a Certified John Ripper User.
Let’s get ready for your final test! 🏆
Definition: John the Ripper is a tool that tests password strength.
Why it is important: It helps find weak passwords.
Simple explanation: John tries to guess passwords to see if they are weak.
Real‑life example: Security experts use John to test company passwords.
School example: Teachers use John to show why strong passwords are important.
Home example: You use John to test your Wi‑Fi password.
Nigerian example: Banks use John to test staff passwords.
Illustration (ASCII):
John the Ripper
+------------------+
| Password tester |
| Uses wordlists |
| Uses rules |
| Cracks hashes |
+------------------+
Mini summary: John is a password testing tool used by good people to find weaknesses.
Definition: Installation is putting John on your computer.
Why it is important: You need to install John before you can use it.
Simple explanation: Like putting a game on your console.
Real‑life example: Installing a new app on your phone.
School example: Installing software on a school computer.
Home example: Installing a new program on your laptop.
Nigerian example: Installing banking software.
Illustration (ASCII):
Installation Steps:
1. Download from openwall.com
2. Extract files
3. Open terminal
4. Run john
Mini summary: You install John and run it from the terminal.
Definition: Wordlists are lists of passwords. Rules change words to create new guesses.
Why it is important: They make John smarter and faster.
Simple explanation: Wordlists are like a dictionary, and rules are like a magic wand.
Real‑life example: A list of common passwords.
School example: A list of vocabulary words.
Home example: A grocery list.
Nigerian example: A list of Nigerian names.
Illustration (ASCII):
Wordlist: [chidi, bola, ade]
Rules: add 1, uppercase, substitute i→!
John tries: chidi, Chidi, chidi1, ch!d!, ...
Mini summary: Wordlists and rules make John powerful.
Definition: Advanced cracking includes using sessions, GPUs, and cracking different file types.
Why it is important: It makes John faster and more versatile.
Simple explanation: Like upgrading from a bicycle to a car.
Real‑life example: Using a fast computer to crack passwords.
School example: Using a powerful server.
Home example: Using a gaming PC.
Nigerian example: Using a high‑performance bank server.
Illustration (ASCII):
Advanced Features:
+ Sessions (save progress)
+ GPU (fast cracking)
+ --fork (multiple cores)
+ ZIP, PDF, RAR cracking
Mini summary: Advanced features make John faster and more powerful.
Definition: Penetration testing is testing systems to find vulnerabilities.
Why it is important: It helps organisations fix weaknesses.
Simple explanation: Like testing a fortress to see if it is secure.
Real‑life example: A company hires a pen tester.
School example: A teacher tests student passwords.
Home example: You test your home security.
Nigerian example: A bank conducts a security audit.
Illustration (ASCII):
Pen Testing Process:
Plan → Gather hashes → Run John → Report → Fix
Mini summary: Pen testing helps find and fix security issues.
Definition: Defensive measures are steps to protect against attacks.
Why it is important: They keep data safe.
Simple explanation: Like building strong walls and doors.
Real‑life example: Using MFA and strong passwords.
School example: Implementing password policies.
Home example: Using a password manager.
Nigerian example: A bank using encryption.
Illustration (ASCII):
Defensive Measures:
+ Strong passwords
+ MFA
+ Salting
+ Account lockout
+ Password manager
+ Education
Mini summary: Defensive measures protect against password attacks.
Definition: Certification is proof that you have the skills to use John properly.
Why it is important: It shows employers and others that you are qualified.
Simple explanation: Like a driver’s license.
Real‑life example: A cybersecurity job requires certification.
School example: A certificate after a course.
Home example: A merit badge.
Nigerian example: A professional certification.
Illustration (ASCII):
Certification Process:
1. Complete all modules
2. Pass the practice exam
3. Take the final exam
4. Receive your certificate
5. Celebrate! 🎉
Mini summary: Certification proves your skills.
Definition: Exam tips are suggestions to help you do well on the test.
Why it is important: They help you be calm and confident.
Simple explanation: Like tips for a spelling bee.
Real‑life example: Getting a good night’s sleep before the exam.
School example: Studying with friends.
Home example: Having a healthy breakfast.
Nigerian example: Arriving early for the exam.
Illustration (ASCII):
Exam Tips:
+ Get good sleep
+ Eat a healthy meal
+ Review your notes
+ Stay calm and focused
+ Read each question carefully
+ Manage your time
Mini summary: Good preparation and tips help you succeed.
Definition: Practice questions are sample questions that test your knowledge.
Why it is important: They help you prepare for the real exam.
Simple explanation: Like a mock test.
Real‑life example: A driver’s ed practice test.
School example: Practice quizzes.
Home example: Practice problems.
Nigerian example: Practice exams for professional certifications.
Illustration (ASCII):
Practice Question Types:
+ Multiple choice
+ True or False
+ Fill‑in‑the‑blank
+ Short answer
+ Scenario‑based
Mini summary: Practice questions help you prepare.
Definition: Real‑world scenarios are situations you might encounter in your career.
Why it is important: They show how John is used in practice.
Simple explanation: Like a story about a real problem.
Real‑life example: A company with weak passwords.
School example: A school with a security breach.
Home example: A family with a compromised Wi‑Fi.
Nigerian example: A bank with a password policy violation.
Illustration (ASCII):
Scenario: Bank Password Audit
1. Collect hashes from staff
2. Run John with wordlists and rules
3. Find weak passwords
4. Report findings
5. Implement new policies
Mini summary: Real‑world scenarios prepare you for the job.
Definition: A study plan is a schedule for reviewing material.
Why it is important: It helps you cover everything and avoid last‑minute stress.
Simple explanation: Like a to‑do list for studying.
Real‑life example: A student planning study time.
School example: A teacher giving a syllabus.
Home example: A family planning activities.
Nigerian example: A professional planning for certification.
Illustration (ASCII):
Study Plan Example:
Day 1: Review Modules 1-2
Day 2: Review Modules 3-4
Day 3: Review Modules 5-6
Day 4: Practice questions
Day 5: Rest and relax
Day 6: Final review
Day 7: Exam day!
Mini summary: A study plan helps you prepare effectively.
Definition: Staying updated means keeping up with new developments in security.
Why it is important: Technology changes, and we need to stay current.
Simple explanation: Like reading the news.
Real‑life example: Following cybersecurity blogs.
School example: Taking new courses.
Home example: Learning about new devices.
Nigerian example: Staying informed about security in Nigeria.
Illustration (ASCII):
Ways to Stay Updated:
+ Read security blogs
+ Follow experts on social media
+ Take additional courses
+ Attend conferences
+ Join online communities
Mini summary: Continuous learning is important in cybersecurity.
Definition: A certified professional is someone who has proven their skills.
Why it is important: It opens doors to new opportunities.
Simple explanation: Like being a recognised expert.
Real‑life example: Working as a security analyst.
School example: Being a top student.
Home example: Being the family tech expert.
Nigerian example: Being a certified cybersecurity specialist in Nigeria.
Illustration (ASCII):
Your Journey:
Learn → Practice → Certify → Work → Help others
Mini summary: You are on your way to a great career!
Definition: Cybersecurity is protecting systems, networks, and data.
Why it is important: It keeps everyone safe online.
Simple explanation: Like a digital police force.
Real‑life example: Protecting online banking.
School example: Keeping student data safe.
Home example: Protecting your family’s information.
Nigerian example: Protecting Nigeria’s digital economy.
Illustration (ASCII):
Cybersecurity Domains:
+ Network security
+ Application security
+ Data security
+ Cloud security
+ Password security (John!)
Mini summary: Cybersecurity is a broad and important field.
Definition: You are ready means you have all the skills and knowledge.
Why it is important: You can now become a Certified John Ripper User!
Simple explanation: Like finishing a race.
Real‑life example: You are prepared for the exam.
School example: You are ready to graduate.
Home example: You are ready to help your family.
Nigerian example: You are ready to work in cybersecurity.
Illustration (ASCII):
🎉 YOU ARE READY! 🎉
+ Knowledge of John
+ Skills in cracking and defence
+ Confidence and determination
+ Ready for the exam!
Mini summary: You are ready to become certified!
Illustration (flowchart):
Start
|
v
Review all modules
|
v
Create study plan
|
v
Practise questions
|
v
Take practice exams
|
v
Identify weak areas
|
v
Rest and relax
|
v
Take the exam
|
v
Become certified! 🎉
Week 1 ── Review Module 1
Week 2 ── Review Module 2
Week 3 ── Review Module 3
Week 4 ── Review Module 4
Week 5 ── Review Module 5
Week 6 ── Review Module 6
Week 7 ── Practice exams
Week 8 ── Final review and exam
| Method | Pros | Cons |
|---|---|---|
| Self‑study | Flexible, at your own pace | Requires discipline |
| Group study | Support, discussion | Can be distracting |
| Practice exams | Realistic preparation | Can be stressful |
| Online courses | Structured learning | May cost money |
Start
|
v
Complete all modules
|
v
Create study plan
|
v
Practice questions
|
v
Take practice exams
|
v
Feel confident?
| |
Yes No
| |
v v
Take exam Review more
| |
v |
Pass? |
| |
Yes |
| v
v Continue
Certify! practice
|
v
End
| Benefit | Description |
|---|---|
| Career advancement | Better job opportunities |
| Credibility | Proves your skills |
| Knowledge | You are an expert |
| Network | Connect with others |
| Confidence | You know what you are doing |
Congratulations! You have completed the final module. Here is what we reviewed:
You are now ready to take the Certified John Ripper User exam. Go ahead and take it – you have all the skills and knowledge you need!
Match the term on the left with its description on the right.
| Term | Description |
|---|---|
| 1. John the Ripper | A. A schedule for studying |
| 2. Wordlist | B. A list of passwords |
| 3. Rule | C. Changes a word |
| 4. Session | D. Saves John's progress |
| 5. Study plan | E. A password testing tool |
Answers: 1‑E, 2‑B, 3‑C, 4‑D, 5‑A
Scenario 1: You are preparing for the certification exam. You have one week left.
Scenario 2: You have aced the exam and are now certified!
Activity: In groups, create a study plan for the certification exam. Share tips and strategies, and help each other prepare.
Activity: Create a one‑page summary of all the key points from Modules 1 to 6. Use it as a quick reference for the exam.
Project: Create a portfolio of your work with John. Include sample commands, screenshots, and a description of what you have learned. This will be a great addition to your CV.
Assignment: Complete a final practical exercise where you crack a test hash, write a report, and present your findings. This simulates a real‑world task.
Challenge: Create a comprehensive security plan for a mock organisation. Include password policies, MFA, incident response, and a schedule for testing with John.
(Answers to Fill-in-the-Blank, True/False, and Multiple Choice are provided within each section.)
Congratulations! You have completed the Certified John Ripper User course. You are now ready to take the certification exam.
After you become certified, you can continue your journey with advanced courses in cybersecurity, ethical hacking, and penetration testing. Keep learning and growing!
Thank you for being part of this course. You are now a guardian of cybersecurity. Go out there and make the world a safer place! 🚀
End of Module 7 – The End of the Course
Hello, certified hero! 👋
You have done it! You are now a Certified John Ripper User. But your journey does not end here. In fact, it is just the beginning.
This module is about what comes next. We will explore advanced career paths in cybersecurity, how to keep learning, and how to use your skills to make a real difference.
Think of this as the "what's next" chapter. You have the key – now let's see all the doors it can open.
Let's explore the future! 🔮
After this module, you will be able to:
Kofi has become the Grand Master Key‑Maker. But he does not stop. He realises that there are many more locks to master – digital locks, network locks, cloud locks.
He decides to explore new lands. He meets other experts, learns new techniques, and even starts teaching others. He becomes a leader in the world of cybersecurity.
His journey shows that certification is not the end – it is the beginning of a grand adventure.
Now it is your turn to start your grand adventure!
Let's go! 🌍
Definition: Your certification is proof that you have the skills to use John the Ripper effectively and ethically.
Why it is important: It opens doors to job opportunities and builds trust with employers.
Simple explanation: Like a driver's license – it shows you can drive safely.
Real‑life example: Employers look for certified professionals.
School example: A diploma shows you finished school.
Home example: A certificate shows you completed a course.
Nigerian example: Employers in Nigeria value certifications.
Illustration (ASCII):
Your Certification:
+ Shows your skills
+ Builds trust
+ Opens job doors
+ Proves you are ethical
+ Sets you apart from others
Mini summary: Your certification is valuable and opens many doors.
Definition: A penetration tester is someone who tests systems to find vulnerabilities – with permission.
Why it is important: They help organisations fix weaknesses before hackers exploit them.
Simple explanation: Like a spy who tests the security of a base.
Real‑life example: A company hires a pen tester to test their network.
School example: A teacher tests students' knowledge.
Home example: You test your home security.
Nigerian example: A bank hires a pen tester.
Illustration (ASCII):
Pen Tester Roles:
+ Test networks
+ Test web applications
+ Test mobile apps
+ Test cloud systems
+ Use tools like John
Mini summary: Pen testers are ethical hackers who help protect systems.
Definition: A security analyst monitors and defends systems from attacks.
Why it is important: They are the first line of defence.
Simple explanation: Like a security guard who watches for intruders.
Real‑life example: A security analyst monitors network traffic.
School example: A hall monitor watches for rule breakers.
Home example: A parent watches for dangers.
Nigerian example: A bank has security analysts.
Illustration (ASCII):
Security Analyst Roles:
+ Monitor systems
+ Investigate alerts
+ Respond to incidents
+ Analyse threats
+ Use tools like John
Mini summary: Security analysts protect systems from attacks.
Definition: A security consultant advises organisations on how to improve their security.
Why it is important: They provide expert guidance.
Simple explanation: Like a doctor who gives health advice.
Real‑life example: A consultant recommends security improvements.
School example: A teacher gives study advice.
Home example: A parent gives life advice.
Nigerian example: A consultant works with Nigerian companies.
Illustration (ASCII):
Security Consultant Roles:
+ Assess security
+ Recommend improvements
+ Help implement policies
+ Train staff
+ Use tools like John
Mini summary: Security consultants advise on how to improve security.
Definition: A cybersecurity engineer builds and maintains security systems.
Why it is important: They create the defences that protect data.
Simple explanation: Like an architect who builds a fortress.
Real‑life example: An engineer configures firewalls.
School example: A student builds a model.
Home example: Someone builds a fence.
Nigerian example: An engineer builds security for a bank.
Illustration (ASCII):
Cybersecurity Engineer Roles:
+ Configure firewalls
+ Build secure networks
+ Implement encryption
+ Develop security tools
+ Use tools like John
Mini summary: Security engineers build and maintain security systems.
Definition: Digital forensics is the investigation of cybercrimes.
Why it is important: It helps catch criminals and recover data.
Simple explanation: Like a detective who solves digital crimes.
Real‑life example: A forensics expert analyses a hacked system.
School example: A student investigates a mystery.
Home example: A parent finds lost items.
Nigerian example: A forensics expert works with the police.
Illustration (ASCII):
Digital Forensics Roles:
+ Investigate breaches
+ Recover data
+ Analyse logs
+ Present findings
+ Use tools like John
Mini summary: Digital forensics experts investigate cybercrimes.
Definition: Continuing education means always learning new things.
Why it is important: Technology changes, and we need to keep up.
Simple explanation: Like updating your phone to the latest version.
Real‑life example: A professional takes new courses.
School example: A student studies new topics.
Home example: A parent learns new skills.
Nigerian example: A professional attends workshops.
Illustration (ASCII):
Ways to Learn:
+ Online courses
+ Books and blogs
+ Conferences
+ Certifications
+ Practice and projects
Mini summary: Lifelong learning is essential in cybersecurity.
Definition: Other certifications are additional credentials you can earn.
Why it is important: They make you more knowledgeable and employable.
Simple explanation: Like collecting badges for different skills.
Real‑life example: A professional earns CEH, CISSP, etc.
School example: A student earns multiple diplomas.
Home example: A parent earns various certifications.
Nigerian example: A professional earns local and international certifications.
Illustration (ASCII):
Other Certifications:
+ CEH (Certified Ethical Hacker)
+ CISSP (Certified Information Systems Security Professional)
+ OSCP (Offensive Security Certified Professional)
+ Security+
+ CISA (Certified Information Systems Auditor)
Mini summary: Additional certifications can boost your career.
Definition: Entrepreneurship is starting your own business.
Why it is important: You can be your own boss and help clients.
Simple explanation: Like opening your own shop.
Real‑life example: A security professional starts a consulting firm.
School example: A student starts a small business.
Home example: A parent starts a side hustle.
Nigerian example: A Nigerian starts a security company.
Illustration (ASCII):
Entrepreneurship Steps:
1. Identify a need
2. Create a business plan
3. Get clients
4. Deliver services
5. Grow your business
Mini summary: Entrepreneurship lets you build your own business.
Definition: Networking is building relationships with others. Mentorship is learning from experienced people.
Why it is important: It helps you learn and find opportunities.
Simple explanation: Like having friends who help you.
Real‑life example: A professional joins a cybersecurity community.
School example: A student joins a club.
Home example: A parent joins a parenting group.
Nigerian example: A professional attends networking events.
Illustration (ASCII):
Networking Tips:
+ Join online communities
+ Attend conferences
+ Find a mentor
+ Be helpful to others
+ Build your personal brand
Mini summary: Networking and mentorship help you grow.
Definition: Your personal brand is how others see you and your skills.
Why it is important: A good brand attracts opportunities.
Simple explanation: Like being known as the "go‑to" person for security.
Real‑life example: A professional shares knowledge on social media.
School example: A student is known for being smart.
Home example: A parent is known for being helpful.
Nigerian example: A professional is known for cybersecurity skills.
Illustration (ASCII):
Building Your Brand:
+ Share your knowledge
+ Be active on social media
+ Write articles or blogs
+ Speak at events
+ Be helpful and ethical
Mini summary: A strong personal brand opens doors.
Definition: The global cybersecurity landscape is the state of security worldwide.
Why it is important: Understanding it helps you see where you fit.
Simple explanation: Like a map of the world.
Real‑life example: Different countries have different security challenges.
School example: Different schools have different rules.
Home example: Different families have different habits.
Nigerian example: Nigeria faces unique cybersecurity challenges.
Illustration (ASCII):
Global Trends:
+ Increase in cyberattacks
+ More regulations
+ Growing demand for experts
+ New technologies (AI, cloud)
+ Need for ethical hackers
Mini summary: The cybersecurity landscape is always changing.
Definition: Making a positive impact means using your skills to help others.
Why it is important: You can make the world a safer place.
Simple explanation: Like being a superhero for the digital world.
Real‑life example: A professional helps non‑profits improve security.
School example: A student helps classmates stay safe online.
Home example: A parent teaches family about security.
Nigerian example: A professional helps Nigerian businesses.
Illustration (ASCII):
Ways to Help:
+ Protect people's data
+ Educate others about security
+ Volunteer for non‑profits
+ Share your knowledge
+ Be a positive role model
Mini summary: You can make a real difference in the world.
Definition: Future trends are new technologies that will shape cybersecurity.
Why it is important: They will create new opportunities and challenges.
Simple explanation: Like the future of cars – self‑driving!
Real‑life example: AI is used to detect threats.
School example: Students learn about new technologies.
Home example: Smart homes need security.
Nigerian example: Nigerian companies adopt AI and cloud.
Illustration (ASCII):
Future Trends:
+ Artificial Intelligence (AI)
+ Cloud security
+ Internet of Things (IoT)
+ Quantum computing
+ Automation
Mini summary: Future trends will shape the cybersecurity field.
Definition: A cybersecurity leader is someone who guides and inspires others.
Why it is important: Leaders make a bigger impact.
Simple explanation: Like a captain of a ship.
Real‑life example: A leader heads a security team.
School example: A student leads a group project.
Home example: A parent leads the family.
Nigerian example: A leader heads a security department.
Illustration (ASCII):
Becoming a Leader:
+ Gain experience
+ Keep learning
+ Help others
+ Be ethical
+ Inspire and guide
Mini summary: You can become a cybersecurity leader.
Illustration (flowchart):
Start
|
v
Get certified
|
v
Explore career paths
|
v
Continue learning
|
v
Consider other certs
|
v
Build network
|
v
Build brand
|
v
Find mentor
|
v
Apply for jobs
|
v
Make impact
|
v
Grow as leader
|
v
End
Year 1 ── Get certified (John)
Year 2 ── Start your first job
Year 3 ── Earn more certifications
Year 5 ── Become a senior professional
Year 7 ── Consider leadership or entrepreneurship
Year 10 ── Become a leader in the field
| Career | Role | Key Skills |
|---|---|---|
| Pen Tester | Ethical hacker | John, network security, web security |
| Security Analyst | Defender | Monitoring, incident response, John |
| Security Consultant | Advisor | Assessment, policy, John |
| Security Engineer | Builder | Firewalls, encryption, John |
| Digital Forensics | Investigator | Analysis, recovery, John |
Start
|
v
Certified John User
|
+---> Pen Tester
|
+---> Security Analyst
|
+---> Security Consultant
|
+---> Security Engineer
|
+---> Digital Forensics
|
+---> Entrepreneurship
|
v
Leader/Expert
| Certification | Focus | Level |
|---|---|---|
| Certified John Ripper User | Password testing | Entry |
| CEH | Ethical hacking | Intermediate |
| CISSP | Security management | Advanced |
| OSCP | Offensive security | Intermediate |
| Security+ | Foundational | Entry |
Congratulations! You have completed the final module of the Certified John Ripper User course. Here is what we explored:
You are now ready to take on the world of cybersecurity. Go out there and make a difference!
Match the term on the left with its description on the right.
| Term | Description |
|---|---|
| 1. Penetration tester | A. Builds security systems |
| 2. Security analyst | B. Ethical hacker |
| 3. Security consultant | C. Investigates cybercrimes |
| 4. Security engineer | D. Monitors systems |
| 5. Digital forensics | E. Advises on security |
Answers: 1‑B, 2‑D, 3‑E, 4‑A, 5‑C
Scenario 1: You have just become certified. You are looking for a job.
Scenario 2: You have been working for a few years and want to start your own business.
Activity: In groups, create a career roadmap for a certified John Ripper User. Include short‑term and long‑term goals.
Activity: Write a one‑page plan for your next steps after certification. Include career goals, learning goals, and networking goals.
Project: Create a portfolio website showcasing your skills, certification, and projects. Include a blog section where you share your knowledge.
Assignment: Write a cover letter and CV tailored to a cybersecurity job. Include your certification and relevant skills.
Challenge: Conduct a mock interview for a cybersecurity role. Prepare answers to common questions and showcase your skills.
(Answers to Fill-in-the-Blank, True/False, and Multiple Choice are provided within each section.)
You have completed the Certified John Ripper User course. This is the end of this course, but it is the beginning of your cybersecurity journey.
We hope you enjoyed the course and learned a lot. Remember, you are now a guardian of cybersecurity. Go out there and make the world a safer place!
Thank you for being part of this course. We are proud of you!
End of Module 8 – The End of the Course