312-50 Question 457
Single answer▪ Cryptography ToolsDuring an internal penetration test, you obtain a Linux server's encrypted SSH private key file (id_rsa) from a developer workstation backup. The key is protected with an unknown passphrase, and the client wants you to demonstrate whether weak passphrases could expose administrative access. Which tool should you use first to prepare this key material in a format suitable for an offline password-cracking attack with John the Ripper?
- A
ssh2john.py
- B
gpg2john
- C
zip2john
- D
openssl rsa -in id_rsa -pubout
Show answer and explanation
Correct answer: A
Explanation
The key task in this scenario is not simply identifying that the SSH private key is encrypted, but selecting the correct cryptography-related tool to transform that key into a format suitable for offline auditing of passphrase strength. John the Ripper commonly uses format-specific helper scripts such as ssh2john.py, zip2john, and gpg2john to extract the relevant hash or key derivation data from supported file types. For an encrypted OpenSSH private key, ssh2john.py is the correct choice. This aligns with common penetration-testing workflows where assessors first convert protected artifacts into crackable representations and then use a password-cracking engine to evaluate whether weak passphrases undermine otherwise valid cryptographic protections. Best practice in authorized testing is to perform such activity only within scope and with client approval, and to document whether the issue stems from weak passphrases rather than a flaw in the SSH algorithm itself. References: John the Ripper jumbo documentation and tooling conventions; OpenSSH private key handling practices; OpenSSL command documentation for RSA key operations.
- A. Correct.
Correct. ssh2john.py is specifically designed to convert SSH private key files, including passphrase-protected private keys, into a hash format that John the Ripper can process for offline cracking. In a real assessment, this is the appropriate preparation step before attempting to test passphrase strength with John.
- B. Incorrect.
Incorrect. gpg2john is used to extract crackable data from GPG/PGP-encrypted files or key material, not standard OpenSSH private key files such as id_rsa. A candidate might choose this because both GPG and SSH involve asymmetric cryptography, but they use different formats and tooling.
- C. Incorrect.
Incorrect. zip2john is intended for ZIP archives protected with legacy ZipCrypto or AES-based ZIP encryption. It does not parse SSH private key formats. This distractor reflects a common misunderstanding that all encrypted files can be handled by the same John conversion utility.
- D. Incorrect.
Incorrect. openssl rsa -in id_rsa -pubout extracts or outputs the public key from an RSA private key if the key can be read successfully, but it does not convert the encrypted private key into a John the Ripper cracking format. It also does not help perform an offline passphrase attack. Someone might select it because OpenSSL is a common cryptography tool, but it is not the correct preparatory utility for John in this scenario.