John the Ripper

John the Ripper#

John the Ripper is a fast password cracker, available for Unix, macOS, Windows, DOS, BeOS, and OpenVMS. The operator complements Hashcat with John for legacy formats and Unix shadow hashes.

Attack modes#

# Brute force
$ john --format=#type hash.txt

# Dictionary
$ john --format=#type --wordlist=dict.txt hash.txt

# Mask
$ john --format=#type --mask=?l?l?l?l?l?l hash.txt -min-len=6

# Incremental
$ john --incremental hash.txt

# Dictionary + rules
$ john --format=#type --wordlist=dict.txt --rules

Rules#

--rules=Single
--rules=Wordlist
--rules=Extra
--rules=Jumbo
--rules=KoreLogic
--rules=All

Increment#

--incremental=Digits
--incremental=Lower
--incremental=Alpha
--incremental=Alnum

Parallel CPU / GPU#

# List OpenCL devices and formats
$ john --list=opencl-devices
$ john --list=formats --format=opencl

# Multi-GPU (example, 3 GPUs)
$ john --format=<OpenCLformat> hash.txt --wordlist=dict.txt --rules --dev=<#> --fork=3

# Multi-CPU (example, 8 cores)
$ john --wordlist=dict.txt hash.txt --rules --dev=<#> --fork=8

Misc#

$ john --test                                            # benchmark
$ john hash.txt --session=example_name                   # session name
$ john --restore=example_name                            # session restore
$ john hash.txt --pot=<potfile> --show                   # show cracked
$ john --wordlist=dict.txt --stdout --external:[filter] > out.txt  # wordlist generation

Basic methodology#

# 1. Default
$ john hash.txt
# 2. Dictionary + rules
$ john --wordlist=dict.txt --rules
# 3. Mask
$ john --mask=?l?l?l?l?l?l hash.txt -min-len=6
# 4. Brute force incremental
$ john --incremental hash.txt

References#

Contents