John the Ripper Cheat Sheet
A comprehensive guide to hash cracking, format conversion, and rules.
1. Basic Cracking
The simplest way to start JtR. It will auto-detect the hash type.
Auto Crack
Attempts to crack using default modes and wordlists.
Specifying Format
If John fails to detect the hash, specify it manually.
Use john --list=formats to see all available hash formats supported by your version.
2. Extracting Hashes (The *2john Tools)
John cannot crack raw files (like ZIP or SSH keys). You must first extract the “hash” into a text file using these tools.
Compressed Files
System & Keys
Documents
3. Wordlists & Rules
Most cracking is done using dictionaries. Rules “mutate” these words (e.g., adding “123” to the end).
Using a Wordlist
Applying Rules (Mangling)
The “Jumbo” version of John has a powerful rule engine to modify words.
Specific Rules
You can define custom rules in john.conf or use built-in sets like “KoreLogic”.
4. Advanced Modes
Incremental Mode (Brute Force)
Tries every possible character combination. Slow, but exhaustive.
Mask Mode
Used when you know part of the password. (e.g., Starts with ‘Pass’, followed by 4 digits).
?d = digit, ?l = lowercase, ?u = uppercase, ?s = special.
Single Crack Mode
Uses the username and GECOS info (Full Name) from the hash file itself to guess passwords.
5. Viewing & Managing
Show Cracked Passwords
John stores cracked passwords in its “pot” file. Use --show to view them.
Restore Session
If you stopped a crack (Ctrl+C), you can resume it later.
View John Configuration
Check which config options are active.