# John The Ripper

> Use for offline password hash auditing during authorized pentests. Trigger on approved hash review, password policy validation, and measuring credential resilience without online authentication attempts.

- Skill: `timsonner/john-the-ripper` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/john-the-ripper`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/john-the-ripper/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/john-the-ripper

---


# John the Ripper

## Purpose

Use this skill for offline password auditing when the engagement explicitly permits analysis of captured or provided password hashes.

## Phase Fit

- Primary: Validation and Controlled Impact Demonstration
- Secondary: Vulnerability Analysis, Retest and Closure

## Use When

- Need to assess password strength from approved offline hashes.
- Need to validate policy weakness without online authentication attempts.
- Need a repeatable retest after password hardening changes.

## Avoid When

- Hashes were not obtained or provided under explicit authorization.
- The engagement does not permit offline password analysis.

## Inputs

- Approved hash file or hash subset
- Expected format and approved wordlist or rules
- Evidence handling rules for credential material

## Procedure

1. Confirm that the hash set is authorized for offline analysis.
2. Start with the narrowest relevant wordlist or mode.
3. Record only the minimum evidence needed to show policy weakness.
4. Avoid over-collecting recovered credentials.
5. Preserve the exact cracking mode for retest.

## Command Syntax

Replace sample paths with approved hash files and approved wordlists.

```bash
# Crack with wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt contoso-hashes.txt

# Apply transformation rules to wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt --rules=Jumbo contoso-hashes.txt

# Crack NTLM hashes
john --format=NT --wordlist=/usr/share/wordlists/rockyou.txt contoso-ntlm.txt

# Crack Kerberos TGS (Kerberoast)
john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt contoso-tgs.txt

# Crack AS-REP hashes
john --format=krb5asrep --wordlist=/usr/share/wordlists/rockyou.txt contoso-asrep.txt

# Show cracked passwords
john --show contoso-hashes.txt

# Show cracked in specific format
john --show --format=NT contoso-ntlm.txt
```

## Evidence to Capture

- Whether weak passwords were recoverable from the approved set
- Hash format and cracking mode used
- Policy-relevant observations without unnecessary credential exposure

## Safety Boundaries

- Keep all recovered material tightly controlled.
- Do not use recovered credentials outside the approved engagement scope.