IntermediateSecurity

John the Ripper Guide: Password Cracking Fundamentals

Learn to use John the Ripper for CPU-based password cracking including wordlist attacks, incremental mode, rule-based cracking, and hash format handling.

#John the Ripper#Password Cracking#Hash Recovery#Password Security#Penetration Testing

The Tool That Cracked Unix for Three Decades

In the mid-1990s, system administrators needed a way to test the strength of their users' passwords. John the Ripper, created by Solar Designer, became the go-to tool — not because it was the fastest, but because it could crack almost any hash format and ran on any Unix system. When the 2013 Adobe breach leaked 130 million unsalted password hashes, John was there — churning through DES-based encryption on CPU cores while GPU tools were still in their infancy.

John the Ripper (often called John) is one of the oldest and most respected password cracking tools. While Hashcat leverages GPU acceleration, John excels at CPU-based cracking.

Prerequisites

Before studying John the Ripper, you should understand:

**Hashes Explained** — How password hashing works

**Password Security Guide** — Password fundamentals

**Linux Commands Explained** — Command line usage

**Hashcat Guide** — Parallel tool knowledge (optional)

Installation

# John is pre-installed in GO KALI
john --help

# Check available formats
john --list=formats | head -30

# Count total formats
john --list=formats | wc -l

# Manual installation (for latest version)
sudo apt install john

Basic Usage

Cracking a Simple Hash

# Create hash file
echo "482c811da5d5b4bc6d497ffa98491e38" > md5_hash.txt

# Crack with default wordlist
john md5_hash.txt

# Specify wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt md5_hash.txt

# Show cracked password
john --show md5_hash.txt

Understanding John's Format

John requires hashes in a specific format:

# Standard format: username:hash
admin:482c811da5d5b4bc6d497ffa98491e38
user1:5d41402abc4b2a76b9719d911017c592
user2:098f6bcd4621d373cade4e832627b4f6

# Linux shadow file format
username:$algorithm$salt$hash

# Converted NTLM hash
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0

Cracking Linux Password Hashes

Using unshadow

The unshadow tool combines /etc/passwd and /etc/shadow into John format:

# Extract system hashes (requires root)
unshadow /etc/passwd /etc/shadow > hashes.txt

# Crack
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

Manual Format

# Create properly formatted hash
username:$6$saltvalue$hashvalue

# Crack SHA-512 crypt hashes (Linux default)
john --format=sha512crypt hashes.txt

Attack Modes

Wordlist Mode

# Basic wordlist attack
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# With rules
john --wordlist=/usr/share/wordlists/rockyou.txt --rules hashes.txt

# Multiple wordlists
john --wordlist=wordlist1.txt hashes.txt
john --wordlist=wordlist2.txt --session=session2 hashes.txt

Incremental Mode (Smart Brute Force)

John's incremental mode is more intelligent than simple brute force — it tries the most likely character combinations first:

# Full incremental (alphanumeric, 8 chars max)
john --incremental hashes.txt

# Incremental with specific charset
john --incremental=LowerNum hashes.txt

# Limit length
john --incremental --max-length=6 hashes.txt

# Built-in incremental modes:
# Incremental:All
# Incremental:Alpha
# Incremental:Upper
# Incremental:LowerNum

Single Crack Mode

Uses login names, GECOS fields, and other personal information as password guesses:

john --single hashes.txt

External Mode

User-defined crack modes using C-like scripts in John's configuration:

john --external=my_mode hashes.txt

Rule-Based Cracking

Wordlist Rules

John includes extensive rule sets:

# List available rules
john --list=rules

# Common rules
# Wordlist — No modifications
# Single — Single crack rules
# Extra — Additional wordlist rules

# Use rules
john --wordlist=wordlist.txt --rules=Single hashes.txt
john --wordlist=wordlist.txt --rules=Extra hashes.txt
john --wordlist=wordlist.txt --rules=Jumbo hashes.txt

# Custom rules in john.conf
[List.Rules:MyRules]
c $d $d $d $d
c $s $d
l s@a s0o

Cracking Different Hash Types

NTLM Hashes

# Format: username:uid:LM:NTLM:::
# Or just the NTLM hash: hash

john --format=nt lm_hashes.txt
john --format=nt --wordlist=rockyou.txt lm_hashes.txt

bcrypt Hashes

# bcrypt is slow even with John
john --format=bcrypt bcrypt_hashes.txt
john --format=bcrypt --wordlist=targeted.txt bcrypt_hashes.txt

MD5 Crypt

john --format=md5crypt hashes.txt

Raw Hashes

# Raw MD5
john --format=raw-md5 hashes.txt

# Raw SHA-256
john --format=raw-sha256 hashes.txt

# Raw SHA-512
john --format=raw-sha512 hashes.txt

Configuration and Tuning

John Configuration File

# Location
/etc/john/john.conf

# Key settings
# [Incremental:All] — Character set and length
# [Incremental:LowerNum] — Lowercase + numbers
# [List.Rules:Wordlist] — Wordlist rules
# [Options] — Global settings

Performance Tuning

# Fork (use multiple CPU cores)
john --fork=4 hashes.txt

# Memory settings
john --mem-file-size=1000 hashes.txt

# Display progress
john --status hashes.txt

Session Management

# Named sessions for multiple attacks
john --session=attack1 hashes.txt
john --session=attack2 hashes.txt --incremental

# Restore a session
john --restore=attack1

# List active sessions
john --list=sessions

# Show progress without cracking
john --status=attack1

Real-World Scenarios

Password Audit

# Extract hashes from Linux system
unshadow /etc/passwd /etc/shadow > system_hashes.txt

# Run progressive cracking
john --wordlist=rockyou.txt system_hashes.txt
john --wordlist=rockyou.txt --rules system_hashes.txt
john --incremental --max-length=8 system_hashes.txt

# Generate report
john --show system_hashes.txt

Cracking ZIP/RAR Files

# Extract hash from ZIP
zip2john protected.zip > zip_hash.txt

# Crack
john --wordlist=rockyou.txt zip_hash.txt

# RAR
rar2john protected.rar > rar_hash.txt
john --wordlist=rockyou.txt rar_hash.txt

Cracking PDF Files

# Extract hash from PDF
pdf2john.pl protected.pdf > pdf_hash.txt

# Crack
john --wordlist=rockyou.txt pdf_hash.txt

Common Mistakes

Not specifying format: John auto-detects formats, but specifying --format can be faster.

Ignoring rules: Rules dramatically increase success rates with minimal performance cost.

Using incremental too early: Incremental mode is slow. Start with wordlists, then escalate.

Forgetting session management: Long-running jobs should use named sessions for resumability.

Best Practices

**Start with wordlist + rules** — Most effective approach

**Use targeted wordlists** — Create based on target intelligence

**Progress through attack modes** — Wordlist -> Rules -> Incremental

**Use sessions** — Resume interrupted attacks

**Monitor progress** — Use --status to check

**Combine with Hashcat** — Use John for CPU-friendly formats, Hashcat for GPU

**Verify hash formats** — Use john --list=formats to find correct names

Related Tools

**Hashcat** — GPU-accelerated parallel (recommended for speed)

**unshadow** — Convert passwd/shadow to John format

**zip2john** — Extract hashes from ZIP files

**rar2john** — Extract hashes from RAR files

**pdf2john** — Extract hashes from PDF files

Hashes Explained

Hashcat Guide

Dictionary Attacks

Password Auditing

Summary

John the Ripper is a versatile CPU-based password cracker. Key features include intelligent incremental mode, extensive hash format support (through utility converters), and rule-based attacks. While Hashcat is faster for GPU-rich environments, John excels with its format conversion tools and works universally on any system.

Knowledge Check

What is the advantage of John's incremental mode over brute force?

How does the unshadow tool prepare Linux hashes for John?

What is the purpose of rules in John the Ripper?

How does session management help with long-running attacks?

What file types can John crack besides password hashes?

Frequently Asked Questions

What is John the Ripper?

John the Ripper (John) is a CPU-based password cracking tool that supports hundreds of hash formats. It excels at automatic hash detection, incremental mode (smart brute force), and cracking Linux shadow files, making it ideal for password auditing.

What is the difference between John and Hashcat?

John runs on CPUs while [Hashcat](/articles/hashcat-guide) uses GPUs for faster raw speed. John offers automatic format detection, session management, and better support for unusual hash types. Many professionals use both tools together for maximum coverage.

What is John's incremental mode?

Incremental mode is John's smart brute force that tests the most likely character combinations first based on probability statistics. It is more efficient than simple brute force because it prioritizes common characters and password lengths rather than exhausting every possibility sequentially.

How do I crack Linux shadow file passwords with John?

Use the `unshadow` tool to combine `/etc/passwd` and `/etc/shadow` into John's format: `unshadow /etc/passwd /etc/shadow > hashes.txt`. Then crack with `john --wordlist=rockyou.txt hashes.txt`. Root access is required to read `/etc/shadow`.

What is John's single crack mode?

Single crack mode (`john --single`) generates password guesses from the username, GECOS fields (full name, home directory), and common variations. It is fast and effective because many users base passwords on their own names or login information.

How do I use rules in John the Ripper?

Add `--rules` to enable built-in rule sets: `john --wordlist=rockyou.txt --rules hashes.txt`. Rules generate variations like capitalization, leet speak, and appended numbers. Custom rules can be defined in `john.conf` under `[List.Rules]`.

How do I manage John cracking sessions?

Use `--session=name` to name a session, `--list=sessions` to view active sessions, and `--restore=name` to resume. This lets you run multiple cracking strategies simultaneously and pause long-running attacks without losing progress.

What hash types can John the Ripper crack?

John supports hundreds of formats including NTLM, MD5, SHA-1/256/512, bcrypt, Kerberos, SSH keys, ZIP files, PDF documents, and more. List all supported formats with `john --list=formats`. The Jumbo version adds significantly more formats.

How do I speed up John the Ripper?

Use `--fork=N` to parallelize across CPU cores, increase memory with `--mem-file-size`, and focus on likely passwords with wordlists plus rules rather than pure incremental mode. GPU-accelerated builds (john-bleeding-jargon) also exist for NVIDIA GPUs.