John the Ripper (Password Cracking Tool)

John the Ripper (Password Cracking Tool)

John the Ripper is one of the most well-known and widely used password cracking tools in the security world. It's open-source and primarily designed for offline password cracking—taking password hashes and attempting to recover the plaintext passwords through various attack modes. This is a guide on John the Ripper (Password Cracking Tool).

Core Attack Modes

Wordlist (Dictionary) Mode — Feeds a list of candidate passwords from a file and compares each hash. The --wordlist flag points to your wordlist, and you can enable rules with --rules to apply mangling transformations (adding numbers, case toggling, leetspeak substitutions, etc.).

Single Crack Mode — A quick first pass that derives candidate passwords from the username, GECOS field, and home directory information in the hash file. It's faster and smarter than a blind dictionary attack. Invoked with --single.

Incremental Mode — A pure brute-force mode that tries every possible character combination within defined character sets and length limits. Powerful but slow for complex passwords. Invoked with --incremental.

Markov Mode — Uses statistical Markov chains to generate candidates based on the probability of character sequences appearing in passwords. More efficient than pure brute-force.

Common Hash Formats and Usage

John auto-detects many hash formats, but you can explicitly specify with --format=. Some common ones:

# Crack an /etc/shadow dump
john --wordlist=/usr/share/wordlists/rockyou.txt shadow.txt

# Specify format (e.g., NTLM, bcrypt, sha512crypt)
john --format=nt --wordlist=rockyou.txt ntlm_hashes.txt
john --format=bcrypt --wordlist=rockyou.txt bcrypt_hashes.txt
john --format=sha512crypt --wordlist=rockyou.txt shadow.txt

# Show cracked passwords
john --show hashes.txt

# Resume a previous session
john --restore

Rules and Mangling

The real power of John comes from its rules engine, defined in /etc/john/john.conf (or john-local.conf). Built-in rules like --rules=Single, --rules=Wordlist, --rules=Jumbo apply increasingly aggressive mutations: appending/prepending digits and special chars, leet substitutions (e → 3, a → @), case flips, duplications, and reversals.

You can also write custom rules. Syntax overview:

Token	Meaning
:	Appends a character
^	Prepends a character
$[0-9]	Appends a digit
c	Capitalizes first letter
l	Lowercases all
u	Uppercases all
T[n]	Toggles case at position n
s/xy/	Substitutes x with y
d	Duplicates word
f	Reflects (reverses) word

Example custom rule: $[0-9]$[0-9]$[!@#] appends two digits and one special character.

Jumbo Community Edition

The Jumbo fork (JohnTheRipper/JohnTheRipper-jumbo on GitHub) massively expands hash format support—hundreds of formats including NTLM, Kerberos TGTs, Bitcoin/Litecoin wallets, PDF/ZIP/RAR/7z archives, SSH private keys, macOS keychains, WPA-PSK handshakes, and dozens of application-specific hashes. If you're doing real penetration testing, you almost certainly want the Jumbo version.

Performance Tips

• Use --fork=N to parallelize across CPU cores

• GPU acceleration is available through various community OpenCL patches

• --session=name lets you name and later resume specific cracking jobs

• --node=1/4 can split a cracking job across four machines (nodes 1 through 4 of 4)

Typical Penetration Testing Workflow

• Extract hashes from whatever you've compromised (SAM dump, /etc/shadow, database dump, kerberoast ticket, WPA handshake, etc.)

• Run single crack mode first (--single)

• Run a fast wordlist with rules (--wordlist=rockyou.txt --rules)

• Run a larger wordlist (like SecLists) with aggressive rules

• If critical and time permits, run incremental/Markov

• Cracked credentials feed into lateral movement and privilege escalation