tools

Overview

John the Ripper (JtR) is a powerful open-source password cracking tool. Use the Jumbo John extended version for maximum format support. Supports wordlist attacks, single crack mode, custom rules, and includes companion tools for converting file formats (zip, rar, SSH keys, shadow files) into crackable hashes.

Target / Context

Password hashes from Linux shadow files, Windows NTLM, ZIP/RAR archives, SSH private keys, and many more formats. Offline cracking tool — requires the hash file locally.

Installation

ℹ︎Installation Commands: 
sudo apt install john

Use Jumbo John for extended format support: https://www.openwall.com/john/

Basic Usage

ℹ︎Basic Usage: 
john [options] [file path]
john --wordlist=/usr/share/wordlists/rockyou.txt hash_to_crack.txt
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hash_to_crack.txt
john --list=formats

Flags & Options

ℹ︎Flags & Options:
FlagDescriptionExample
—wordlistSpecify wordlist to use—wordlist=/usr/share/wordlists/rockyou.txt
—formatSpecify hash format—format=raw-md5 / —format=nt
—singleSingle crack mode using GECOS field and word mangling—single —format=raw-md5
—ruleApply a named custom rule—rule=PoloPassword
—list=formatsList all supported hash formatsjohn —list=formats
—showShow previously cracked passwordsjohn —show hash.txt

Common Use Cases

Wordlist Attack

ℹ︎Commands: 
john --wordlist=/usr/share/wordlists/rockyou.txt hash_to_crack.txt
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hash_to_crack.txt

Windows NTLM format flag: —format=nt

Linux Shadow File Cracking

Must unshadow first to combine /etc/passwd and /etc/shadow into one crackable file.

ℹ︎Commands: 
unshadow [path to passwd] [path to shadow] > unshadowed.txt
john --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt
john --format=sha512crypt --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt

Single Crack Mode

Uses information from the GECOS field alongside word mangling techniques to generate candidates. Example mutations: Markus → MArkus, Markus1, Markus!

ℹ︎Commands: 
john --single --format=[format] [path to file]

Note: Prepend the hash with the username before running single crack mode. Format: username:hash — Example: mike:1efee03cdc

Custom Rules

Define rules in /etc/john/john.conf or /opt/john/john.conf.

ℹ︎Commands: 
john --wordlist=[path to wordlist] --rule=PoloPassword [path to hash file]
ℹ︎Rule Syntax Reference:
ModifierDescription
AzAppend characters to end of word
A0Prepend characters to start of word
cCapitalize character positionally
[0-9]Match any digit 0-9
[!$%@]Match any of these symbols

Example rule definition in john.conf: [List.Rules:PoloPassword] cAz"[0-9] [!£$%@]"

  • c — Capitalize first letter
  • Az — Append to end
  • [0-9] — Followed by a digit
  • [!£$%@] — Followed by a symbol

Full reference: https://www.openwall.com/john/doc/RULES.shtml

Cracking ZIP Files

ℹ︎Commands: 
zip2john [options] [zip file] > zip_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt

Cracking RAR Archives

ℹ︎Commands: 
rar2john [rar file] > rar_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt rar_hash.txt

IPMI 2.0 RAKP Hash Cracking

IPMI 2.0 RAKP hashes are obtainable without authentication due to a protocol-level flaw. See IPMI for context.

ℹ︎Commands: 
john --format=rakp --wordlist=/usr/share/wordlists/rockyou.txt ipmi.txt

Cracking SSH Key Passwords

Converts an id_rsa private key into a crackable hash format.

ℹ︎Commands: 
python /usr/share/john/ssh2john.py [id_rsa file] > ssh_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt ssh_hash.txt
  • Password Cracking

References / Images