jperezduerto john-the-ripper Agent Skill
When to Use This Skill
Use this skill when:
- Cracking password hashes obtained during a penetration test
- Extracting crackable hashes from ZIP, RAR, PDF, SSH keys, KeePass, or BitLocker
- The user asks about john, JtR, or john the ripper
- Choosing between wordlist, rules, incremental, or mask attack modes
- Managing crack sessions, restoring interrupted jobs, or reading the potfile
- Deciding whether to use John or Hashcat for a specific hash type
What John the Ripper Does
John the Ripper is an open-source password cracking tool that supports hundreds of hash types and five primary attack modes. The Jumbo community release significantly extends the core version with additional formats, rule sets, and *2john extraction utilities. It is used when Hashcat is unavailable (CPU-only environments) or when its rule syntax or format auto-detection is more convenient.
Installation
# Community (core) — Kali / Debian
sudo apt install john
# Jumbo (recommended — adds formats, rules, *2john tools)
sudo apt install john # Kali ships Jumbo by default
# From source (Jumbo)
sudo apt install build-essential libssl-dev yasm libgmp-dev libpcap-dev pkg-config libbz2-dev
git clone https://github.com/openwall/john -b bleeding-jumbo
cd john/src && ./configure && make -s clean && make -sj$(nproc)
# Binary at: john/run/john
# Install to PATH
sudo ln -s $(pwd)/john/run/john /usr/local/bin/john
# Docker
docker pull ghcr.io/openwall/john
docker run --rm -v $(pwd):/data ghcr.io/openwall/john /data/hashes.txt
# Verify
john --list=build-options
john --version
Supported Hash Formats
# List all supported formats
john --list=formats
# List formats matching a keyword
john --list=formats | grep -i ntlm
john --list=formats | grep -i bcrypt
john --list=formats | grep -i sha256
# Common format names
# md5crypt — $1$ Linux MD5
# sha512crypt — $6$ Linux SHA-512 (/etc/shadow modern)
# sha256crypt — $5$
# bcrypt — $2b$ (slow, GPU-friendly via Hashcat instead)
# NT — Windows NTLM (unsalted MD4)
# lm — Windows LM (very weak, splits into 7-char halves)
# mscash — MS-CACHE v1 (DCC)
# mscash2 — MS-CACHE v2 (DCC2)
# krb5asrep — Kerberos AS-REP hash (AS-REProasting)
# krb5tgs — Kerberos TGS hash (Kerberoasting)
# zip — ZIP encrypted archives
# rar5 — RAR5 encrypted archives
# pdf — PDF encrypted files
# SSH — SSH private key passphrases
# KeePass — KeePass database master password
# BitLocker — BitLocker recovery key / password
# WPA — WPA/WPA2 handshake (PMKID or 4-way)
# PKZIP — Legacy PKZIP encryption
# office — Microsoft Office 2007–2019 documents
# pgpdisk — PGP/GPG disk encryption
Hash Extraction (*2john Utilities)
# ZIP archive
zip2john secret.zip > zip.hash
zip2john -S secret.zip > zip.hash # Skip checksum validation
# RAR archive
rar2john secret.rar > rar.hash
# 7-Zip
7z2john secret.7z > 7z.hash
# PDF
pdf2john.pl secret.pdf > pdf.hash # Perl version
pdf2john secret.pdf > pdf.hash # Binary version
# SSH private key
ssh2john id_rsa > ssh.hash
# KeePass 1.x / 2.x
keepass2john keepass.kdbx > keepass.hash
keepass2john -k keyfile.key keepass.kdbx > keepass.hash # with keyfile
# BitLocker
bitlocker2john -i disk.img > bitlocker.hash
# Microsoft Office
office2john secret.docx > office.hash
# WPA/WPA2 (from pcap)
hccapx2john capture.hccapx > wpa.hash
wpapcap2john capture.pcap > wpa.hash
# PGP / GPG private key
gpg2john private.gpg > gpg.hash
# /etc/shadow (Linux)
sudo cat /etc/shadow > shadow.txt
# John reads shadow directly — no conversion needed
john shadow.txt
# NTLM from secretsdump output (impacket)
# secretsdump.py -outputfile dump domain/admin:pass@dc.local
# Results in dump.ntds; extract NTLM column:
cut -d: -f4 dump.ntds > ntlm.hash
# Combine passwd + shadow
unshadow /etc/passwd /etc/shadow > combined.txt
john combined.txt
Attack Modes
Auto-Detect (Single-Crack) Mode
# John auto-detects format and applies GECOS rules first
john hashes.txt
# Force specific format
john --format=NT hashes.txt
john --format=sha512crypt shadow.txt
# Auto-detect format without cracking (just identify)
john --show=left hashes.txt # show uncracked
Wordlist Mode
# Basic wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
# With format
john --wordlist=/usr/share/wordlists/rockyou.txt --format=NT hashes.txt
# With pipe from stdin
cat wordlist.txt | john --stdin hashes.txt
Rules-Based Attack
Rules mutate wordlist candidates. John Jumbo ships many built-in rulesets.
# Built-in rulesets
john --wordlist=rockyou.txt --rules=Jumbo hashes.txt # Jumbo default rules
john --wordlist=rockyou.txt --rules=KoreLogic hashes.txt # KoreLogic rules (extensive)
john --wordlist=rockyou.txt --rules=All hashes.txt # All known rules (slow)
john --wordlist=rockyou.txt --rules=Best64 hashes.txt # Top 64 Hashcat-equivalent rules
john --wordlist=rockyou.txt --rules=T0XlC hashes.txt # T0XlC specialized rules
john --wordlist=rockyou.txt --rules=Single hashes.txt # GECOS/username mangling
# Custom rules in john.conf / john.ini
# [List.Rules:MyRules]
# Az"[0-9]" — append digit
# A0"[!@#$]" — prepend symbol
# c — capitalize first char
# r — reverse word
# d — duplicate word
# l — lowercase all
# List available rulesets
john --list=rules
Incremental Mode (Brute Force)
# Full brute force with built-in character sets
john --incremental hashes.txt # Default charset (all printable)
john --incremental=Alpha hashes.txt # a-z only
john --incremental=Digits hashes.txt # 0-9 only
john --incremental=Alnum hashes.txt # a-z 0-9
john --incremental=ASCII hashes.txt # All 95 printable ASCII
# Limit length
john --incremental=Alpha --min-length=6 --max-length=8 hashes.txt
Mask Mode (Hybrid Brute Force)
# Mask syntax: ?l=lowercase ?u=upper ?d=digit ?s=symbol ?a=all ?w=word
john --mask='?u?l?l?l?d?d?d?d' hashes.txt # Aaaa1234 pattern
john --mask='Password?d?d' hashes.txt # Password followed by 2 digits
john --mask='?w?d?d' --wordlist=rockyou.txt hashes.txt # word + 2 digits
# Define custom charset
john --mask='?1?1?1?d?d' --1='[aeiou]' hashes.txt
# Combine with rules
john --mask='?w?d?d?s' --wordlist=rockyou.txt --rules hashes.txt
Prince Mode (PRINCE algorithm)
# Generates combinations from wordlist elements
john --prince=wordlist.txt hashes.txt
john --prince=wordlist.txt --rules=Jumbo hashes.txt
Session Management
# Start named session
john --session=myengagement --wordlist=rockyou.txt hashes.txt
# Restore interrupted session
john --restore=myengagement
# Restore default session
john --restore
# List active / interrupted sessions
ls ~/.john/
# Show progress without interrupting
kill -USR1 $(pidof john) # sends SIGUSR1 — prints status to stdout
Potfile and Showing Cracked Passwords
# Cracked passwords are stored in ~/.john/john.pot by default
cat ~/.john/john.pot
# Show cracked passwords for a hash file
john --show hashes.txt
john --show --format=NT ntlm.hash
# Show uncracked
john --show=left hashes.txt
# Use a custom potfile location
john --pot=./engagement.pot --wordlist=rockyou.txt hashes.txt
john --pot=./engagement.pot --show hashes.txt
# Clear potfile (reset cracked state)
> ~/.john/john.pot
Cracking Specific Hash Types
Linux /etc/shadow
unshadow /etc/passwd /etc/shadow > combined.txt
john --wordlist=rockyou.txt --rules=Jumbo combined.txt
john --show combined.txt
Windows NTLM (from secretsdump / mimikatz)
# secretsdump output: user:rid:lmhash:nthash
# Extract NT hashes:
cut -d: -f4 dump.ntds | sort -u > ntlm_hashes.txt
john --format=NT --wordlist=rockyou.txt --rules=Jumbo ntlm_hashes.txt
Kerberoasting (TGS Hashes)
# Hashes from Impacket GetUserSPNs.py or Rubeus
john --format=krb5tgs --wordlist=rockyou.txt --rules=Jumbo kerb_hashes.txt
AS-REP Roasting
john --format=krb5asrep --wordlist=rockyou.txt asrep_hashes.txt
SSH Key Passphrase
ssh2john id_rsa > id_rsa.hash
john --wordlist=rockyou.txt --rules id_rsa.hash
john --show id_rsa.hash
KeePass Database
keepass2john database.kdbx > keepass.hash
john --wordlist=rockyou.txt --rules=Jumbo keepass.hash
Common Workflows
Post-Compromise Credential Harvesting
# 1. Extract hashes from domain controller
impacket-secretsdump domain/admin:pass@dc.local -outputfile dump
# 2. Extract NT hashes
cut -d: -f4 dump.ntds | sort -u > ntlm.hash
# 3. Fast wordlist attack
john --format=NT --wordlist=/usr/share/wordlists/rockyou.txt ntlm.hash
# 4. Rules pass
john --format=NT --wordlist=/usr/share/wordlists/rockyou.txt --rules=Jumbo ntlm.hash
# 5. Review results
john --format=NT --show ntlm.hash | tee cracked.txt
CTF Hash Cracking Pipeline
# 1. Identify hash type
echo '$6$rounds=5000$salt$hash...' | john --stdin --format=auto --show
# 2. Quick crack attempt
john --wordlist=/usr/share/wordlists/rockyou.txt --format=sha512crypt target.hash
# 3. Rules pass
john --wordlist=/usr/share/wordlists/rockyou.txt --rules=All target.hash
# 4. Incremental fallback (short passwords only)
john --incremental=Alnum --min-length=1 --max-length=6 target.hash
John vs Hashcat
| Feature | John the Ripper | Hashcat |
|---|---|---|
| GPU acceleration | Limited (OpenCL) | Excellent (CUDA/OpenCL) |
| CPU performance | Strong | Strong |
| Rule syntax | John rules (verbose) | Hashcat rules (compact) |
| Format support | Wider (many *2john utils) | Fewer, but major types covered |
| Auto-detect format | Yes | No (must specify -m mode) |
| Incremental (brute) | Built-in | Built-in |
| Mask attack | --mask |
-a 3 |
| Prince mode | Built-in | Separate binary |
| Best for | CPU-only, broad format support, CTF convenience | GPU rig, maximum speed on common types |
# Equivalent commands
# John: wordlist + rules
john --wordlist=rockyou.txt --rules=Jumbo hashes.txt
# Hashcat equivalent
hashcat -m 1000 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule
Advanced Techniques
Loopback Mode (feed cracked passwords back)
# Feed cracked passwords as new wordlist candidates
john --wordlist=rockyou.txt --rules hashes.txt
john --loopback hashes.txt # use john.pot as wordlist + apply rules again
Custom Wordlist Generation
# Generate targeted wordlist with crunch
crunch 8 10 abcdefghijklmnopqrstuvwxyz0123456789 -o custom.txt
john --wordlist=custom.txt hashes.txt
# Use CeWL to generate wordlist from target site
cewl https://target.example.com -d 3 -m 6 -w site_words.txt
john --wordlist=site_words.txt --rules=Jumbo hashes.txt
Distributed Cracking
# Split hash file across multiple john instances
split -n l/4 hashes.txt chunk_
john --wordlist=rockyou.txt --rules chunk_aa &
john --wordlist=rockyou.txt --rules chunk_ab &
john --wordlist=rockyou.txt --rules chunk_ac &
john --wordlist=rockyou.txt --rules chunk_ad &
# Merge potfiles afterward
cat node1.pot node2.pot node3.pot node4.pot | sort -u > combined.pot
Troubleshooting
| Issue | Fix |
|---|---|
No password hashes loaded |
Wrong --format=; use --list=formats to find correct name |
| Very slow bcrypt/scrypt | Switch to Hashcat with GPU; these are inherently slow |
| Potfile already contains all hashes | Delete or move ~/.john/john.pot |
Segmentation fault on large file |
Split hash file into chunks |
| Format auto-detect wrong | Force with --format=; run john --test --format=X to validate |
| Rules not found | Ensure using Jumbo build; check john --list=rules |
| Session restore fails | Check ~/.john/ for .rec file; use --restore=sessionname |
Built by Red Hound InfoSec — On-demand offensive security expertise for SMBs. 20+ years of Fortune 500 experience. Penetration testing, attack surface analysis, and security consulting.
Related reading: 5 Active Directory Misconfigurations We See in Every Engagement