John the Ripper

We had to undertake a password auditor project recently, so one of the key performance indicators was to use a password cracker to check the veracity of the passwords. The best-known one was 'John the Ripper' so we went ahead and used it. Its main strength lies in detecting password hashes and running against the very best ones (apart from AES). The password crackers can be run from one location for convenience and this also adds to the effectiveness of the application. 'John the Ripper' mainly relies on incorporating brute force attacks and dictionary table attacks on plaintext passwords and this is where t is more effective.

It is best suited in those environments where complexity is not the key. We've used it fairly extensively in our UNIX to find weak UNIX passwords and in Windows environments too. It's very easy to get hold of as it is essentially Open Source, although a paid version is now available and we are thinking of looking at this proposition in-depth to see if it is viable. We found it easy to install and deploy across our systems. Patching was fairly regular, so we always had the latest version. It holds its own against DES and Blowfish encryption algorithms among many others.