/etc/shadow

[spawn]

Folks,

On gentoo, ubuntu, ( that I tested ) when I run john --users=root shadow

No password hashes loaded

I tried too unshadow /etc/passwd /etc/shadow > mypwd

the same message

In present day it still works ?

Thanks in advanced

[lupin]

You will need to unshadow the passwd and shadow files before you can use john on them. After you use unshadow, check the format of the output file and ensure that there is a password hash present in the entry for root.

The username is the first field and the password is the second field in the file (which will be colon separated). If you see a ! or a * in that second field it means that there is no password for that account.

If there is a password hash for roots account in your file, but john still tells you no hashes loaded, then you may need to force the hash type using the "--format" switch. Check the help output for valid formats for your version of john. The version that comes with BackTrack is patched to accept extra hash types, so if you are not using BackTrack you may need to add your own patches to get extra types supported.

You should be able to identify the hash type by checking its format (especially the first few characters which may separate certain values using $ characters) and Googling for more details. The documentation for the version of Linux you are using may also provide clues as to what hash type is used.

[spawn]

Originally Posted by lupin

You should be able to identify the hash type by checking its format (especially the first few characters which may separate certain values using $ characters) and Googling for more details.

Perfect man !

Thanks