John the Ripper Cheat Sheet
Complete Password Cracking Reference
Wordlist attacks • Rules • Hash formats • Multiple platforms
What is John the Ripper?
John the Ripper is a free and open-source password cracking tool. Originally developed for Unix, it now runs on many platforms and supports hundreds of hash types. The "Jumbo" version adds even more formats and features.
John comes pre-installed on Kali Linux. Official site: openwall.com/john.
📦 Installation
Kali Linux
sudo apt install john
Jumbo Version (recommended)
git clone https://github.com/openwall/john
cd john/src && ./configure && make
macOS (Homebrew)
brew install john-jumbo
🎯 Basic Usage
# Crack with default settings (auto-detect format)john hashes.txt# Use wordlistjohn --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt# Specify hash formatjohn --format=raw-md5 hashes.txt# Show cracked passwordsjohn --show hashes.txt# List supported formatsjohn --list=formats# Check session statusjohn --status# Restore interrupted sessionjohn --restore
⚔️ Attack Modes
| Mode | Flag | Description |
|---|---|---|
| Single | --single | Uses login names, GECOS, home dir names |
| Wordlist | --wordlist=FILE | Dictionary attack |
| Incremental | --incremental | Brute force all combinations |
| Mask | --mask=MASK | Pattern-based brute force |
| External | --external=MODE | Custom C-like functions |
# Single mode (fastest, uses usernames)john --single hashes.txt# Wordlist with rulesjohn --wordlist=rockyou.txt --rules hashes.txt# Incremental (all lowercase, up to 8 chars)john --incremental=Lower hashes.txt# Mask modejohn --mask='?u?l?l?l?d?d?d?d' hashes.txt
🎭 Mask Mode Characters
| Placeholder | Character Set |
|---|---|
| ?l | Lowercase (a-z) |
| ?u | Uppercase (A-Z) |
| ?d | Digits (0-9) |
| ?s | Special characters |
| ?a | All printable ASCII |
| ?h | Hex lowercase (0-9, a-f) |
| ?H | Hex uppercase (0-9, A-F) |
# Password1 patternjohn --mask='?u?l?l?l?l?l?l?l?d' hashes.txt# 8 digit PINjohn --mask='?d?d?d?d?d?d?d?d' hashes.txt# Static prefix with variable suffixjohn --mask='Company?d?d?d?d' hashes.txt
📋 Common Hash Formats
| Format | Description |
|---|---|
| raw-md5 | Raw MD5 |
| raw-sha1 | Raw SHA1 |
| raw-sha256 | Raw SHA256 |
| raw-sha512 | Raw SHA512 |
| sha512crypt | Linux shadow file ($6$) |
| sha256crypt | Linux shadow file ($5$) |
| md5crypt | Linux/BSD MD5 crypt ($1$) |
| bcrypt | Blowfish crypt ($2a$, $2b$, $2y$) |
| nt | Windows NTLM |
| lm | Windows LM |
| mscash2 | MS Cache 2 (Domain Cached) |
| krb5tgs | Kerberos TGS |
# List all formatsjohn --list=formats# Search for formatjohn --list=formats | grep -i mysql
🔧 Hash Extraction Tools (*2john)
John includes many tools to extract hashes from various file types:
# Linux shadow fileunshadow /etc/passwd /etc/shadow > unshadowed.txt# ZIP filezip2john protected.zip > zip.hash# RAR filerar2john protected.rar > rar.hash# 7z file7z2john protected.7z > 7z.hash# PDF filepdf2john protected.pdf > pdf.hash# Office documentsoffice2john document.docx > office.hash# SSH private keyssh2john id_rsa > ssh.hash# KeePass databasekeepass2john database.kdbx > keepass.hash# GPG/PGP private keygpg2john private.key > gpg.hash# Kerberos ticketskirbi2john ticket.kirbi > kirbi.hash
📜 Word Mangling Rules
# Use default rulesjohn --wordlist=rockyou.txt --rules hashes.txt# Use specific rule setjohn --wordlist=rockyou.txt --rules=best64 hashes.txt# Jumbo rules (more comprehensive)john --wordlist=rockyou.txt --rules=jumbo hashes.txt# List available rulesjohn --list=rules
Common Rule Sets
| Single | Default single crack rules |
| Wordlist | Default wordlist rules |
| best64 | Top 64 most effective rules |
| jumbo | Comprehensive rule set |
| KoreLogic | Very thorough rules |
⚡ Performance Options
| Flag | Description |
|---|---|
| --fork=N | Fork N processes for parallel cracking |
| --node=X/Y | Split work for distributed cracking |
| --devices=N | OpenCL device selection |
| --min-length=N | Minimum password length |
| --max-length=N | Maximum password length |
# Use all CPU coresjohn --fork=8 --wordlist=rockyou.txt hashes.txt
💾 Session Management
# Name a sessionjohn --session=mycrack --wordlist=rockyou.txt hashes.txt# Restore sessionjohn --restore=mycrack# Check status (while running)john --status=mycrack# Show cracked passwordsjohn --show hashes.txt# Show cracked passwords in format user:passwordjohn --show --format=raw-md5 hashes.txt
🔥 Common Cracking Scenarios
# Crack Linux shadow fileunshadow /etc/passwd /etc/shadow > hashes.txt john hashes.txt# Crack NTLM hashesjohn --format=nt --wordlist=rockyou.txt ntlm_hashes.txt# Crack MD5 with rulesjohn --format=raw-md5 --wordlist=rockyou.txt --rules hashes.txt# Crack encrypted ZIPzip2john file.zip > zip.hash john zip.hash# Crack SSH private keyssh2john id_rsa > ssh.hash john ssh.hash# Crack Kerberoast ticketsjohn --format=krb5tgs --wordlist=rockyou.txt kerberos.hash
📚 Additional Resources
🔐 John the Ripper Cheat Sheet Complete!
You now have a comprehensive reference for one of the most legendary password cracking tools. From shadow files to encrypted archives, these commands are essential for any security professional.
Ready to crack your next hash!