John the Ripper is a technical assessment tool used to test the weakness of which of the following?

John the Ripper operates on credential hashes to recover passwords, not to enumerate or assess the validity of usernames.

File permission auditing requires tools such as AccessChk or find with permission flags - John the Ripper has no capability to inspect filesystem access controls.

Firewall ruleset analysis requires dedicated tools such as Nmap or firewall policy auditors - John the Ripper does not interact with network filtering rules.

John the Ripper operates on password hashes obtained from files such as /etc/shadow or NTLM dumps, applying dictionary attacks, brute force, and rule-based mangling to recover the original plaintext password. Security professionals use it in penetration tests and audits to demonstrate that specific user passwords do not meet complexity requirements. Its sole function is evaluating password strength, not any other system attribute.