John the Ripper — Complete Reference

External: Internal All The Things — Hash Cracking

What is John the Ripper?

John the Ripper (JtR) is an open-source password security auditing and recovery tool. It auto-detects hash types, supports hundreds of formats, and can crack passwords using wordlists, brute-force, and rule mutations. The *2john family of tools converts protected files into crackable hash formats.

OSCP use: Use John for SSH keys, ZIP files, Linux /etc/shadow, and any hash that Hashcat doesn’t handle conveniently on a CPU. The *2john tools are essential for converting found files into crackable format.

Install (Kali)

sudo apt update && sudo apt install -y john

Verify: john · converters: ssh2john, zip2john, etc.

Full install index → Installation - Kali Setup

Versions

Version	Description
`john`	Standard community edition
`john` (Jumbo)	Extended version with more formats — use this one (default on Kali)

john --version

Syntax

john [options] <hashfile>

📌 1) All Common Flags

Flag	Description
`--wordlist=<file>`	Use a wordlist file for dictionary attack
`--format=<format>`	Specify hash format (skip auto-detection)
`--rules[=<ruleset>]`	Enable word mangling rules (default: `Wordlist` ruleset)
`--rules=Jumbo`	Use the Jumbo ruleset (very thorough)
`--rules=KoreLogic`	Use the KoreLogic ruleset
`--incremental[=<mode>]`	Brute-force mode (all chars, digits, alpha, etc.)
`--incremental=Digits`	Brute-force digits only
`--incremental=Alpha`	Lowercase letters only
`--incremental=Alnum`	Letters and digits
`--mask=<mask>`	Mask attack (like Hashcat masks)
`--single[=<section>]`	Single-crack mode (uses login name, GECOS, etc.)
`--show`	Show already-cracked passwords from pot file
`--show=left`	Show hashes not yet cracked
`--list=formats`	List all supported hash formats
`--list=rules`	List all available rule sets
`--test[=<duration>]`	Benchmark all formats (or one format with `--format`)
`--pot=<file>`	Use a custom pot file (stores cracked hashes)
`--nopotfile`	Don’t use or update the pot file
`--session=<name>`	Name this session (for pause/resume)
`--restore[=<name>]`	Resume a saved session
`--status[=<name>]`	Show status of running/saved session
`--fork=<N>`	Fork N processes (use multiple CPU cores)
`--node=<N>`	Node number for distributed cracking
`--max-run-time=<sec>`	Stop after N seconds
`--max-length=<N>`	Only crack hashes with passwords up to N chars
`--min-length=<N>`	Minimum password length to try
`-stdin`	Read candidates from stdin (pipe wordlist in)
`--pipe`	Alias for `-stdin`
`--dupe-suppression`	Don’t output duplicate cracked passwords
`--loopback[=<file>]`	Use already-cracked passwords as the next wordlist
`--markov[=<options>]`	Markov mode attack
`--stdout[=<length>]`	Print candidates to stdout (don’t crack — useful for generating wordlists)
`--external=<mode>`	Use an external mode (custom C filter)

📌 2) Basic Usage

Dictionary attack (most common)

john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

Dictionary + rules (better hit rate)

john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt --rules

Specify format explicitly (skip auto-detect)

john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=NT
john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=sha512crypt

Show cracked passwords

john hashes.txt --show
john hashes.txt --show --format=NT    # Specify format if needed

See what’s left uncracked

john hashes.txt --show=left

📌 3) Hash Format Detection

Auto-detect

John usually auto-detects formats. If it guesses wrong, specify with --format:

# List all supported formats
john --list=formats
john --list=formats | grep -i "ntlm\|sha\|md5\|ssh\|zip"
 
# Test detection on a hash file
john --format=auto hashes.txt

Common `--format` values

Format	Hash Type
`NT`	Windows NTLM
`LM`	Windows LM
`netntlmv2`	NetNTLMv2 (Responder captures)
`sha512crypt`	Linux `/etc/shadow` $6$
`sha256crypt`	Linux `/etc/shadow` $5$
`md5crypt`	Linux `/etc/shadow` $1$
`bcrypt`	$2a$ , $2b$
`Raw-MD5`	Plain MD5
`Raw-SHA1`	Plain SHA1
`Raw-SHA256`	Plain SHA256
`Raw-SHA512`	Plain SHA512
`ssh`	SSH private key passphrase
`zip`	ZIP file password
`rar`	RAR archive password
`7z`	7-Zip archive password
`pdf`	PDF password
`office`	Microsoft Office document
`keepass`	KeePass database
`wpapsk`	WPA/WPA2 PSK
`krb5tgs`	Kerberos TGS-REP (Kerberoast)
`krb5asrep`	Kerberos AS-REP
`PBKDF2-HMAC-SHA256`	Django, many web apps
`phpass`	WordPress / phpBB ( $P$ )
`mysql`	MySQL password hash
`mssql`	MSSQL password hash
`postgres`	PostgreSQL MD5
`vnc`	VNC password
`oracle`	Oracle hash

📌 4) Attack Modes

Single-crack mode

Uses the username and GECOS info to generate candidates — good first pass:

john hashes.txt --single
john hashes.txt --single --format=NT

Wordlist mode

john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

Wordlist + rules

# Default rules
john hashes.txt --wordlist=rockyou.txt --rules
 
# Specific ruleset
john hashes.txt --wordlist=rockyou.txt --rules=Jumbo
john hashes.txt --wordlist=rockyou.txt --rules=KoreLogic
john hashes.txt --wordlist=rockyou.txt --rules=best64    # If available

Incremental (brute-force)

# All printable chars (very slow)
john hashes.txt --incremental
 
# Digits only (great for PINs)
john hashes.txt --incremental=Digits
 
# Lowercase alpha
john hashes.txt --incremental=Alpha
 
# Alphanumeric
john hashes.txt --incremental=Alnum

Mask attack (targeted brute-force)

John uses ?l ?u ?d ?s ?a like Hashcat:

# 8-char all lowercase
john hashes.txt --mask=?l?l?l?l?l?l?l?l
 
# Capital + 6 lowercase + digit
john hashes.txt --mask=?u?l?l?l?l?l?l?d
 
# 4-8 digit PIN
john hashes.txt --mask=?d?d?d?d --min-length=4 --max-length=8
 
# Custom charset (define ?1 as lowercase+digits)
john hashes.txt --mask=?1?1?1?1?1?1 --1=?l?d

Loopback (use cracked passwords as the next wordlist)

# After cracking some hashes, use the results to crack more
john hashes.txt --wordlist=rockyou.txt --rules
john hashes.txt --loopback --rules

Pipe from stdin

# Generate candidates with another tool, pipe into John
cat wordlist.txt | john --stdin hashes.txt
crunch 6 8 abc123 | john --stdin hashes.txt

📌 5) Session Management

# Name a session
john hashes.txt --wordlist=rockyou.txt --rules --session=mysession
 
# Check status of running session (from another terminal)
john --status=mysession
 
# Interrupt (Ctrl+C) — saves automatically as "john.rec" or named session file
 
# Resume
john --restore
john --restore=mysession
 
# List saved sessions
ls ~/.john/*.rec

📌 6) Performance

# Use multiple CPU cores (fork 4 processes)
john hashes.txt --wordlist=rockyou.txt --fork=4
 
# Benchmark a format
john --test --format=sha512crypt
john --test                     # All formats
 
# Check current speed during a run
# Press Enter while running to see status

📌 7) The *2john Tools

These convert protected files into a hash format John can crack. This is the core OSCP workflow.

ssh2john — SSH Private Key Passphrase

# Convert private key to crackable hash
ssh2john id_rsa > id_rsa.hash
python3 /usr/share/john/ssh2john.py id_rsa > id_rsa.hash   # Alternative path
 
# Crack
john id_rsa.hash --wordlist=/usr/share/wordlists/rockyou.txt
john id_rsa.hash --wordlist=/usr/share/wordlists/rockyou.txt --rules
 
# Show result
john id_rsa.hash --show
 
# Then use the cracked passphrase
chmod 600 id_rsa
ssh -i id_rsa user@TARGET
# Enter cracked passphrase when prompted

zip2john — ZIP Archive Password

zip2john archive.zip > zip.hash
zip2john protected.zip > zip.hash
 
john zip.hash --wordlist=/usr/share/wordlists/rockyou.txt
john zip.hash --wordlist=/usr/share/wordlists/rockyou.txt --rules
john zip.hash --show

rar2john — RAR Archive Password

rar2john archive.rar > rar.hash
 
john rar.hash --wordlist=/usr/share/wordlists/rockyou.txt
john rar.hash --show

7z2john — 7-Zip Archive Password

7z2john archive.7z > 7z.hash
python3 /usr/share/john/7z2john.py archive.7z > 7z.hash    # Alternative
 
john 7z.hash --wordlist=/usr/share/wordlists/rockyou.txt --format=7z
john 7z.hash --show

pdf2john — PDF Password

pdf2john protected.pdf > pdf.hash
python3 /usr/share/john/pdf2john.py protected.pdf > pdf.hash
 
john pdf.hash --wordlist=/usr/share/wordlists/rockyou.txt --format=PDF
john pdf.hash --show

office2john — Microsoft Office Password (Word, Excel, PowerPoint)

office2john protected.docx > office.hash
office2john protected.xlsx > office.hash
python3 /usr/share/john/office2john.py protected.docx > office.hash
 
john office.hash --wordlist=/usr/share/wordlists/rockyou.txt
john office.hash --show

After crack → decrypt/open → Office Documents

keepass2john — KeePass Database

keepass2john database.kdbx > keepass.hash
keepass2john -k keyfile.key database.kdbx > keepass.hash   # With keyfile
 
john keepass.hash --wordlist=/usr/share/wordlists/rockyou.txt --format=keepass
john keepass.hash --show

gpg2john — GPG Private Key Passphrase

gpg2john privatekey.gpg > gpg.hash
gpg2john privatekey.asc > gpg.hash
 
john gpg.hash --wordlist=/usr/share/wordlists/rockyou.txt
john gpg.hash --show

hash-identifier / haiti — Identify Unknown Hashes

# hash-identifier (built into Kali)
hash-identifier
# Paste hash when prompted
 
# haiti (better, command-line friendly)
haiti 5f4dcc3b5aa765d61d8327deb882cf99

Other *2john tools

Tool	Converts
`bitlocker2john`	BitLocker encrypted drive
`dmg2john`	macOS DMG disk image
`ethereum2john`	Ethereum wallet
`keychain2john`	macOS Keychain
`lastpass2john`	LastPass vault export
`bitwarden2john`	Bitwarden vault
`pwsafe2john`	Password Safe database
`truecrypt2john`	TrueCrypt volume
`luks2john`	Linux LUKS encrypted volume
`hccap2john`	WPA/WPA2 capture
`wpapcap2john`	WPA PCAP capture
`vnc2john`	VNC password file
`radius2john`	RADIUS shared secret

# Find all *2john tools on the system
find / -name "*2john*" 2>/dev/null
ls /usr/share/john/

📌 8) Common Hash-Specific Workflows

Linux /etc/shadow

After you have passwd and shadow (copied from target or read via LFI/SUID/etc.):

Step 1: Save both files locally

# On target — copy off box
cat /etc/passwd
cat /etc/shadow
 
# Save as passwd and shadow in your working dir (Kali)

→ Registry Hives and Linux Equivalents · Linux

Step 2: Combine them

Use the unshadow utility (included with John the Ripper):

unshadow passwd shadow > hashes.txt

Example output:

root:$y$j9T$...
john:$6$...
bob:$1$...

Prefix	Hash type
$y$	yescrypt (modern Debian/Ubuntu)
$6$	sha512crypt
$1$	md5crypt (legacy)

Step 3: Crack with John

john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt
john hashes.txt --show

Direct paths on box (if cracking in place):

unshadow /etc/passwd /etc/shadow > unshadowed.txt
john unshadowed.txt --wordlist=/usr/share/wordlists/rockyou.txt
john unshadowed.txt --show

Shadow only (no passwd file):

john shadow.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=sha512crypt
john shadow.txt --show

→ GPU alternative: Hashcat -m 1800 (sha512), -m 500 (md5), -m 7400 (yescrypt)

Windows NTLM hashes

# From secretsdump / hashdump output
# Format: username:RID:LM:NT:::
# Extract just the NT hashes
cut -d: -f4 secretsdump.txt > ntlm.txt
 
john ntlm.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=NT
john ntlm.txt --show --format=NT

NetNTLMv2 (Responder capture)

john netntlmv2.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=netntlmv2
john netntlmv2.txt --show

Kerberoast (TGS-REP)

john kerberoast.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=krb5tgs
john kerberoast.txt --show

AS-REP Roast

john asrep.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=krb5asrep
john asrep.txt --show

📌 9) John vs Hashcat — When to Use Which

Scenario	Prefer	Reason
SSH private key	John (`ssh2john`)	Built-in format support
ZIP / RAR / 7z	John (`zip2john` etc.)	Built-in format support
KeePass / Office / PDF	John	Easy conversion + cracking
NTLM, NetNTLMv2, Kerberoast	Hashcat	GPU acceleration = faster
Linux shadow	Either	John simpler; Hashcat faster
Large wordlists + rules	Hashcat	GPU is orders of magnitude faster
Quick CPU-only crack	John	Simpler workflow, good for small sets
Unknown hash type	John	Better auto-detection

📌 Quick OSCP Cheat Sheet (Copy/Paste)

# SSH private key passphrase
ssh2john id_rsa > id_rsa.hash
john id_rsa.hash --wordlist=/usr/share/wordlists/rockyou.txt
john id_rsa.hash --show
 
# ZIP password
zip2john archive.zip > zip.hash
john zip.hash --wordlist=/usr/share/wordlists/rockyou.txt
 
# Linux shadow — unshadow passwd + shadow first
unshadow passwd shadow > hashes.txt
john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt
john hashes.txt --show
 
# NTLM hashes
john ntlm.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=NT
john ntlm.txt --show --format=NT
 
# NetNTLMv2 (Responder)
john netntlmv2.txt --wordlist=/usr/share/wordlists/rockyou.txt
 
# Any hash — with rules for better hit rate
john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt --rules
 
# Show all cracked results
john hashes.txt --show
 
# List all supported formats
john --list=formats | grep -i "target_format"
 
# Multi-core (4 forks)
john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt --rules --fork=4

Pearson's OSCP Notebook

Explorer

John