John the Ripper

John the Ripper (“john”) is an open-source password-cracking tool maintained by Openwall. It supports hundreds of hash and cipher types and is a standard tool for offline password attacks during post-exploitation.

Basic usage

john --format=$HASH_FORMAT \
     --wordlist=$WORDLIST $PASSWORD_HASH_FILE

Always pass --format when you know the hash type — many formats look identical, and john’s auto-detection is unreliable. John cracks one format per invocation; --list=formats enumerates everything the build supports.

John accepts Metasploit hashdump output directly with --format=NT.

Important

Cracked hash:password pairs are recorded in ~/.john/john.pot and skipped on later runs. Re-running john on the same file prints “No password hashes left to crack” — grep john.pot for the hash instead of re-cracking.

Cracking modes

Mode	Flag	Behavior
Wordlist	--wordlist=FILE	Try each candidate, optionally with rules
Single crack	--single	Derive candidates from username/GECOS fields — exploits passwords based on login data
Incremental	--incremental	Brute-force character-space search (default when nothing else is given)
External	--external=MODE	Custom candidate generator written in john’s C-like config language

Single crack mode needs no wordlist. On unshadowed UNIX files it exploits GECOS data; on a bare hash, format the line as USERNAME:HASH so john has material to mangle.

Rules — wordlist mutation

Users satisfy “complexity” requirements predictably: append/prepend digits and symbols, capitalize the first letter. John’s rules expand a wordlist to cover these permutations. Rules live in john.conf under [List.Rules:Name] and are selected with --rules=Name.

john --wordlist=$WORDLIST \
     --rules=$RULE_SET \
     --stdout > $OUTFILE

--stdout makes john emit the mutated candidates instead of cracking — this turns john into a wordlist generator. --rules=KoreLogic is a widely used, aggressive ruleset.

Writing custom rules

Rule syntax is terse (documented fully in Openwall’s RULES doc). Common building blocks:

• Az"..." — append each character in the string to the word
• ^X / $X — prepend / append the literal character X
• [0-9], [!@#], [0-3] — character classes and ranges

Examples of complete rules:

# word + one digit + ! or @
Az"[0-9]" $[!@]
 
# word + two digits
Az"[0-9][0-9]"
 
# word + one of !,@,# + one digit
Az"[!@#][0-9]"
 
# word + digit 0-3, with ! or @ prepended
Az"[0-3]" ^[!@]

Add them to john.conf (or an included file) as:

[List.Rules:MyRule]
Az"[0-9]" $[!@]
Az"[0-9][0-9]"

Then generate the expanded list:

john --wordlist=$ORIGINAL_WORDLIST \
     --rules=MyRule \
     --stdout >> $NEW_WORDLIST

Rules pair naturally with targeted base wordlists from cewl-custom-wordlist-generator and cupp-common-user-passwords-profiler.

Helper applications

Tool	Purpose
hash-identifier	Suggest hash types matching a sample (names do not map 1:1 onto john --format names)
unshadow	Combine /etc/passwd + /etc/shadow into a john-ready file (see unix-password-hash-formats)
zip2john	Extract a crackable hash from an encrypted ZIP
rar2john	Extract a crackable hash from an encrypted RAR
ssh2john.py	Extract a crackable hash from an encrypted ssh private key

John is prone to false positives on SSH keys, so it exhausts the whole wordlist “just in case” — don’t read a completed run with no crack as definitive.

Sources

• John the Ripper documentation (Openwall)
• John the Ripper — wordlist rules syntax (Openwall)
• John the Ripper — cracking modes (Openwall)
• openwall/john — GitHub

Related: cewl-custom-wordlist-generator, cupp-common-user-passwords-profiler, unix-password-hash-formats, unix-permissions, ssh, etc-shadow-weak-permissions, etc-passwd-weak-permissions, hydra, h8mail