John The Ripper

βš™οΈ Cracking Modes in John

πŸ”Ή Single Crack Mode

john --format=<hash_type> <hash_file>

Example:

john --format=sha256 hashes_to_crack.txt
  • Uses internal wordlists and rules

  • Saves results to ~/.john/john.pot

  • View cracked passwords:

john --show hashes_to_crack.txt

πŸ”Έ Wordlist Mode

john --wordlist=<wordlist.txt> --rules <hash_file>
  • Applies word transformations

  • Allows custom or multiple wordlists

  • Often faster than brute-force


πŸ”Ί Incremental Mode

  • Tries every combo of defined charset (default: a-zA-Z0-9)

  • Great for cracking unknown or complex passwords

  • Very resource-intensive


πŸ—ƒοΈ Cracking Specific File Formats

John can crack password-protected files by using helper tools to extract hashes.

πŸ”„ General Workflow

πŸ”§ Supported Tools

Tool
Description

pdf2john

PDF password hashes

ssh2john

SSH private key hashes

mscash2john

MS Cache v2 hashes

keychain2john

macOS Keychain

rar2john

RAR file hashes

pfx2john

PKCS#12 hashes

truecrypt_volume2john

TrueCrypt

keepass2john

KeePass DB

zip2john

ZIP archives

office2john

MS Office docs

wpa2john

WPA/WPA2 handshakes

πŸ” Find all available tools on pwnbox:


πŸ’¬ Example Cracking Formats

Hash Type
Example Command

AFS

john --format=afs hashes.txt

BSDi

john --format=bsdi hashes.txt

LM

john --format=LM hashes.txt

NT

john --format=nt hashes.txt

MySQL

john --format=mysql hashes.txt

raw-md5

john --format=raw-md5 hashes.txt

SHA-256

john --format=raw-sha256 hashes.txt

PDF

john --format=pdf hashes.txt

ZIP

john --format=zip hashes.txt

WPA

john --format=wpa hashes.txt

Oracle

john --format=oracle hashes.txt

... many more ...


πŸ§ͺ Pro Tips

  • πŸ’‘ Keep wordlists updated (e.g., SecListsarrow-up-right)

  • πŸ”„ Use multiple cracking modes for best results

  • 🧠 Combine --rules with --wordlist for advanced cracking

  • 🧾 Monitor progress with john --status or john --show

  • πŸ“ Cracked passwords are stored in: ~/.john/john.pot

Last updated