John The Ripper

John the Ripper (JtR) is a CPU-based password cracking tool that detects hash types automatically and works with a wide range of formats. It ships with a set of *2john scripts that extract hashes from files, plus built-in wordlist, rules, and incremental (brute-force) modes. It is commonly used in penetration testing to crack NTLM, NetNTLMv2, Kerberos tickets, and Unix shadow hashes.

---

Cheatsheet

# == Basic Usage ==
john hashfile.txt # auto-detect format and crack with default wordlist
john --show hashfile.txt # show already-cracked passwords
john --pot=file.pot hashfile.txt # specify pot file (default ~/.john/john.pot)
john --list=formats # list all supported formats

# == Wordlist Attack ==
john --wordlist=rockyou.txt hashfile.txt # use specific wordlist
john --wordlist=rockyou.txt --rules hashfile.txt # apply rules to wordlist
john --rules=All hashfile.txt # use the "All" ruleset

# == Single Crack Mode (default when no mode given) ==
john --single hashfile.txt # use username + mangling rules
john --single --format=NT hashfile.txt # single mode with format

# == Incremental (brute-force) ==
john --incremental hashfile.txt # full incremental (can be very slow)
john --incremental:Digits hashfile.txt # brute-force numeric only
john --incremental:LowerNum hashfile.txt # lowercase + digits
john --incremental:Alpha hashfile.txt # alpha characters

# == Mask / External Mode ==
john --mask='?u?l?l?l?l?d?d' hashfile.txt # mask pattern (jumbo builds)
john --mask='?d?d?d?d?d' --min-length=5 --max-length=5 hashfile.txt
# Mask placeholders: ?l lower, ?u upper, ?d digit, ?s special, ?a all

# == Specifying the Format ==
john --format=NT hashfile.txt # NTLM
john --format=LM hashfile.txt # LM
john --format=sha512crypt hashfile.txt # Unix sha512crypt ($6$)
john --format=md5crypt hashfile.txt # Unix md5crypt ($1$)
john --format=bcrypt hashfile.txt # bcrypt ($2a$/b$)
john --format=sha256crypt hashfile.txt # Unix sha256crypt ($5$)
john --format=netntlmv2 hashfile.txt # NetNTLMv2
john --format=krb5tgs hashfile.txt # Kerberos TGS ticket
john --format=krb5asrep hashfile.txt # Kerberos AS-REP
john --format=zip hashfile.txt # ZIP encrypted archives
john --show --format=NT hashfile.txt # show cracked for a format

# == Hash Extraction (2john scripts) ==
unshadow passwd shadow > unshadowed.txt # combine /etc/passwd + /etc/shadow
john --format=sha512crypt unshadowed.txt rockyou.txt # crack unshadowed

# == Common Extraction Workflows ==
# NTLM from Windows SAM (via secretsdump/pypykatz)
john --format=NT ntlm.hash rockyou.txt

# NetNTLMv2 captured with responder
john --format=netntlmv2 netntlmv2.hash rockyou.txt

# Kerberoast / AS-REP roast tickets (impacket GetUserSPNs)
john --format=krb5tgs kerberoast.txt rockyou.txt
john --format=krb5asrep asrep.txt rockyou.txt

# Wordpress hash
john --format=phpass wp-hash.txt rockyou.txt

# Encrypted archive types
zip2john archive.zip > zip.hash
7z2john archive.7z > 7z.hash
rar2john archive.rar > rar.hash
john --format=zip zip.hash
john --format=7z 7z.hash
john --format=rar rar.hash

# KeePass database
keepass2john database.kdbx > keepass.hash
john --format=keepass keepass.hash rockyou.txt

# SSH private key
ssh2john id_rsa > ssh.hash
john --format=ssh ssh.hash rockyou.txt

# PDF
pdf2john document.pdf > pdf.hash
john pdf.hash rockyou.txt

# == Performance & Options ==
john --status # check running session status
john --session=name hashfile.txt # name a session (resume via john --restore=name)
john --restore=name # resume an interrupted session
john --fork=4 hashfile.txt # parallel across 4 cores
john --show --users=admin hashfile.txt # show cracks for a specific user
john --show --format=NT --users=user1,user2 hashfile.txt
john --wordlist=rockyou.txt --format=NT --rules=best64 hashfile.txt