Password Cracking with John the Ripper

John the Ripper (John) is a fast password cracker that supports hundreds of hash types and cracking modes. It's one of the most popular password security auditing tools used by penetration testers and security professionals worldwide. This lesson covers John's features, usage, and practical password cracking techniques.

What You'll Learn

What is John the Ripper
Installation and setup
Supported hash types
Cracking modes (single, wordlist, incremental)
Working with password hashes
Creating custom wordlists
Rule-based attacks
Hash identification
Practical cracking scenarios
Performance optimization

What is John the Ripper?

Overview

John the Ripper is a free, open-source password cracking tool that:

Detects hash types automatically
Supports 400+ hash and cipher types
Runs on Windows, Linux, macOS
Offers multiple cracking modes
Can utilize CPU and GPU
Includes built-in wordlists and rules

Use Cases:

Password auditing
Penetration testing
Recovering lost passwords
Security research
Compliance testing

Installation

Kali Linux (Pre-installed)

# Check version
john --version

# Update to latest
sudo apt update
sudo apt install john

Install John the Ripper Jumbo

Jumbo version includes many more hash formats:

# Install dependencies
sudo apt install git build-essential libssl-dev zlib1g-dev

# Clone repository
cd /opt
sudo git clone https://github.com/openwall/john.git
cd john/src

# Compile
sudo ./configure
sudo make -s clean
sudo make -sj4

# Create symlink
sudo ln -s /opt/john/run/john /usr/local/bin/john

# Verify
john --version

macOS

# Using Homebrew
brew install john-jumbo

Windows

1. Download from: https://www.openwall.com/john/
2. Extract to C:\john
3. Add C:\john\run to PATH
4. Open cmd: john --version

Basic Usage

Simple Example

# Create hash file
echo 'admin:$1$salt$qJH7.N4xYta3aEG/dfqo/0' > hashes.txt

# Crack with default wordlist
john hashes.txt

# Show cracked passwords
john --show hashes.txt

Cracking Modes

1. Single Crack Mode

Uses username and GECOS info to generate passwords:

# Fast mode using user info
john --single hashes.txt

# Example: username "alice" might try:
# alice, Alice, ALICE, alice1, alice123, alice!

2. Wordlist Mode

Uses dictionary file:

# Use specific wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Kali Linux common wordlists:
/usr/share/wordlists/rockyou.txt        (14M passwords)
/usr/share/wordlists/fasttrack.txt
/usr/share/john/password.lst            (John's default)

# Extract rockyou.txt (if needed)
sudo gunzip /usr/share/wordlists/rockyou.txt.gz

3. Incremental Mode (Brute Force)

Tries all possible combinations:

# Full incremental (all printable chars)
john --incremental hashes.txt

# ASCII mode (faster)
john --incremental=ASCII hashes.txt

# Digits only
john --incremental=Digits hashes.txt

# Custom charset
john --incremental=LowerNum hashes.txt

Character sets:

Alpha:     a-zA-Z
Digits:    0-9
Alnum:     a-zA-Z0-9
LowerNum:  a-z0-9
UpperNum:  A-Z0-9
ASCII:     All printable ASCII

Working with Password Hashes

Linux Shadow File

Extract hashes from /etc/shadow:

# Combine passwd and shadow
sudo unshadow /etc/passwd /etc/shadow > unshadowed.txt

# Crack
john --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt

# Show results
john --show unshadowed.txt

Windows SAM Hashes

Extract from Windows:

# Using pwdump (on Windows)
pwdump7 > hashes.txt

# Using samdump2 (Linux)
samdump2 SYSTEM SAM > hashes.txt

# Crack NTLM hashes
john --format=NT hashes.txt

Hash Formats

Specify format manually:

# MD5
john --format=raw-md5 hashes.txt

# SHA-1
john --format=raw-sha1 hashes.txt

# SHA-256
john --format=raw-sha256 hashes.txt

# SHA-512
john --format=raw-sha512 hashes.txt

# NTLM (Windows)
john --format=NT hashes.txt

# bcrypt
john --format=bcrypt hashes.txt

# MD5 (Unix)
john --format=md5crypt hashes.txt

List All Formats

# Show all supported formats
john --list=formats

# Search for specific format
john --list=formats | grep -i md5

# Common formats:
Raw-MD5, Raw-SHA1, Raw-SHA256, Raw-SHA512
NT, LM
md5crypt, sha256crypt, sha512crypt
bcrypt, scrypt
Django, Drupal, WordPress
MySQL, PostgreSQL

Hash Identification

Using `hash-identifier`

# Hash identifier tool
hash-identifier

# Enter hash:
5f4dcc3b5aa765d61d8327deb882cf99

# Output: Possible types: MD5

Using John's Format Detection

# Let John detect format
john hashes.txt

# John will try to auto-detect and show:
# Loaded 1 password hash (Raw-MD5 [MD5 128/128 AVX 4x3])

Rule-Based Attacks

Built-in Rules

Apply mutation rules to wordlist:

# Use default rules
john --wordlist=wordlist.txt --rules hashes.txt

# Specific ruleset
john --wordlist=wordlist.txt --rules=Jumbo hashes.txt

# List available rules
john --list=rules

Common Rule Transformations

Original: password

Rules might generate:
password1, password123, password!
Password, PASSWORD, PaSsWoRd
drowssap (reversed)
p@ssword, passw0rd
password2023, password2024

Custom Rules

Create custom rule in john.conf:

# Edit configuration
nano /etc/john/john.conf

# Add custom rule
[List.Rules:MyRules]
# Append year
$2 $0 $2 $3
# Append !
$!
# Capitalize first letter
c
# Append 123
$1 $2 $3

# Use custom rule
john --wordlist=wordlist.txt --rules=MyRules hashes.txt

Session Management

Save and Restore Sessions

# John automatically saves progress
john --wordlist=rockyou.txt hashes.txt

# Stop with Ctrl+C, resume later
john --restore

# Specific session name
john --session=mysession --wordlist=rockyou.txt hashes.txt
john --restore=mysession

# Show status
john --status

Practical Examples

Example 1: Crack MD5 Hashes

# Create hash file
cat > md5_hashes.txt << EOF
admin:5f4dcc3b5aa765d61d8327deb882cf99
user1:098f6bcd4621d373cade4e832627b4f6
user2:5d41402abc4b2a76b9719d911017c592
EOF

# Crack with wordlist
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt md5_hashes.txt

# Show cracked passwords
john --show --format=raw-md5 md5_hashes.txt

# Output:
# admin:password
# user1:test
# user2:hello

Example 2: Crack Linux Shadow Passwords

# Extract hashes (requires root)
sudo unshadow /etc/passwd /etc/shadow > mypasswd.txt

# Start cracking
john --wordlist=/usr/share/wordlists/rockyou.txt mypasswd.txt

# Use rules for better results
john --wordlist=/usr/share/wordlists/rockyou.txt --rules mypasswd.txt

# Show results
john --show mypasswd.txt

Example 3: Crack Windows NTLM Hashes

# Hash file format:
# username:uid:lm_hash:ntlm_hash:::

cat > ntlm_hashes.txt << EOF
Administrator:500:NO PASSWORD*********************:8846F7EAEE8FB117AD06BDD830B7586C:::
Guest:501:NO PASSWORD*********************:31D6CFE0D16AE931B73C59D7E0C089C0:::
EOF

# Crack NTLM hashes
john --format=NT ntlm_hashes.txt

# With wordlist
john --format=NT --wordlist=/usr/share/wordlists/rockyou.txt ntlm_hashes.txt

# Show cracked
john --show --format=NT ntlm_hashes.txt

Example 4: Crack ZIP Password

# Extract hash from ZIP
zip2john encrypted.zip > zip_hash.txt

# Crack
john --wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt

# Show password
john --show zip_hash.txt

Example 5: Crack SSH Private Key

# Extract hash from SSH key
ssh2john id_rsa > ssh_hash.txt

# Crack passphrase
john --wordlist=/usr/share/wordlists/rockyou.txt ssh_hash.txt

# Show passphrase
john --show ssh_hash.txt

Practical Pentesting Scenarios

Scenario 1: Web Application Hash Dump

# Obtained from SQL injection:
# SELECT username, password FROM users

# hashes.txt:
admin:5f4dcc3b5aa765d61d8327deb882cf99
alice:e10adc3949ba59abbe56e057f20f883e
bob:098f6bcd4621d373cade4e832627b4f6

# Step 1: Identify hash type
echo "5f4dcc3b5aa765d61d8327deb882cf99" | hash-identifier
# MD5

# Step 2: Crack with John
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Step 3: Apply rules
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt --rules hashes.txt

# Step 4: Show results
john --show --format=raw-md5 hashes.txt

Scenario 2: WordPress Password Hashes

# Obtained from database:
# SELECT user_login, user_pass FROM wp_users

# WordPress uses phpass (MD5-based)

# hashes.txt:
admin:$P$B1234567890abcdefghijklmnopqrst

# Crack
john --format=phpass --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# With rules
john --format=phpass --wordlist=/usr/share/wordlists/rockyou.txt --rules hashes.txt

Scenario 3: Cracking Multiple Hash Types

# Mixed hash file
cat > mixed_hashes.txt << EOF
user1:5f4dcc3b5aa765d61d8327deb882cf99
user2:5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8
user3:$1$salt$qJH7.N4xYta3aEG/dfqo/0
EOF

# John auto-detects and cracks
john --wordlist=/usr/share/wordlists/rockyou.txt mixed_hashes.txt

# Or specify multiple formats
john --format=raw-md5 --wordlist=wordlist.txt user1_hashes.txt
john --format=raw-sha1 --wordlist=wordlist.txt user2_hashes.txt
john --format=md5crypt --wordlist=wordlist.txt user3_hashes.txt

Custom Wordlist Creation

Using CeWL (Custom Word List generator)

# Generate wordlist from website
cewl -d 2 -m 5 -w wordlist.txt https://target.com

# Options:
# -d 2      (depth of 2 links)
# -m 5      (minimum word length 5)
# -w file   (output file)

# Use with John
john --wordlist=wordlist.txt hashes.txt

Using Crunch

# Generate all 4-character passwords (a-z)
crunch 4 4 -o wordlist.txt

# Specific charset
crunch 6 6 0123456789 -o pins.txt

# With pattern
crunch 8 8 -t password@@ -o wordlist.txt
# Generates: password00, password01, ..., password99

# Use with John
john --wordlist=wordlist.txt hashes.txt

john2* Utilities

Extract Hashes from Files

# ZIP files
zip2john encrypted.zip > hash.txt

# RAR files
rar2john encrypted.rar > hash.txt

# PDF files
pdf2john encrypted.pdf > hash.txt

# Office documents
office2john document.docx > hash.txt

# SSH private keys
ssh2john id_rsa > hash.txt

# Bitcoin wallet
bitcoin2john wallet.dat > hash.txt

# KeePass database
keepass2john database.kdbx > hash.txt

# Then crack
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

Performance Optimization

Show Statistics

# Check cracking speed
john --test

# Output shows passwords/second for each format
# Benchmarking: Raw-MD5 [MD5 128/128 AVX 4x3]
# Many salts:     12345K c/s real, 12345K c/s virtual

Multi-Core Usage

# John automatically uses all CPU cores

# Limit CPU usage
john --fork=2 hashes.txt    # Use 2 cores

# Check status of all processes
john --status

GPU Acceleration

John the Ripper Jumbo supports OpenCL for GPU:

# List OpenCL devices
john --list=opencl-devices

# Use GPU
john --format=raw-sha256-opencl --wordlist=rockyou.txt hashes.txt

# Much faster for supported hash types:
# raw-md5-opencl
# raw-sha1-opencl
# raw-sha256-opencl
# NT-opencl

Tips and Tricks

1. Start with Fast Modes

# Progression from fast to slow:
john --single hashes.txt                    # Fastest
john --wordlist=fasttrack.txt hashes.txt    # Fast
john --wordlist=rockyou.txt hashes.txt      # Medium
john --wordlist=rockyou.txt --rules hashes.txt  # Slower
john --incremental hashes.txt               # Slowest

2. Combine Multiple Wordlists

# Concatenate wordlists
cat wordlist1.txt wordlist2.txt wordlist3.txt > combined.txt

# Remove duplicates
sort -u combined.txt -o combined_unique.txt

# Use
john --wordlist=combined_unique.txt hashes.txt

3. Mask Attacks

# If you know password format, use mask
# Example: password has 8 chars, starts with capital, ends with 2 digits

# Use hashcat for mask attacks (better suited)
# Or create targeted wordlist with crunch
crunch 8 8 -t Password@@ -o targeted.txt
john --wordlist=targeted.txt hashes.txt

Quick Reference

Basic Usage:
john hashes.txt
john --wordlist=rockyou.txt hashes.txt
john --format=raw-md5 hashes.txt

Modes:
--single                    (fast, user info)
--wordlist=file.txt        (dictionary)
--incremental              (brute force)
--rules                    (apply mutations)

Session:
--session=name             (name session)
--restore                  (resume)
--status                   (show progress)

Display:
--show                     (show cracked)
--show --format=raw-md5    (specific format)

Extract Hashes:
zip2john file.zip > hash.txt
rar2john file.rar > hash.txt
ssh2john id_rsa > hash.txt
pdf2john file.pdf > hash.txt

Common Formats:
raw-md5, raw-sha1, raw-sha256
NT (NTLM), LM
md5crypt, sha256crypt, sha512crypt
bcrypt, phpass

Resources

Wordlists

rockyou.txt: 14M passwords (most common)
SecLists: https://github.com/danielmiessler/SecLists
CrackStation: https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm
Weakpass: https://weakpass.com/

Password Security:

Password Storage Security Research - Understand how developers should store passwords securely and why weak hashing enables cracking

Documentation

# John documentation
man john

# List formats
john --list=formats

# List rules
john --list=rules

# Show examples
john --list=format-details

Next Steps

Practice on CTF challenges (HackTheBox, TryHackMe)
Build custom wordlists for targeted attacks
Learn hashcat for GPU-accelerated cracking
Study hash functions and their weaknesses
Explore password storage best practices

John the Ripper is essential for password auditing. Master it for both offensive and defensive security!

"John the Ripper: Because 'password123' shouldn't pass security audits."