John the Ripper Cheatsheet

John the Ripper (JtR) is an open-source password cracking tool supporting brute-force and dictionary attacks. The jumbo variant is recommended for penetration testing — it includes performance optimizations, multilingual wordlists, 64-bit support, and more hash formats.

Installation

sudo apt-get install john        # standard
sudo apt-get install john-jumbo  # recommended

List all supported formats:

john --list=formats

Basic Syntax

john [options] <hash_file>

Cracking Modes

Single crack mode — Most useful when targeting Linux credentials. Generates candidates from the victim’s username, home directory name, and GECOS values (full name, phone, etc.). A user whose real name is “Bob Smith” might use “Smith1” as their password.

Wordlist mode — Classic dictionary attack. Rules (--rules) apply transformations such as appending numbers, capitalizing letters, and adding special characters.

Incremental mode — Most exhaustive. Generates candidates dynamically using a statistical model (Markov chains), prioritizing likely passwords. Does not rely on a predefined wordlist.

Common Options

Common Hash Formats

2john Conversion Tools

Usage:

<tool> <file_to_crack> > file.hash
john file.hash

Find all available 2john tools:

locate *2john*

Useful Examples

Crack Linux Shadow File

john --single passwd

Dictionary Attack with Rules

john --wordlist=/usr/share/wordlists/rockyou.txt --rules hashes.txt

Crack Specific Format

john --format=raw-md5 --wordlist=passwords.txt md5_hashes.txt

Show Cracked Passwords

john --show hashes.txt

Crack ZIP File

zip2john protected.zip > zip.hash
john --wordlist=rockyou.txt zip.hash

Crack SSH Private Key

ssh2john id_rsa > ssh.hash
john --wordlist=passwords.txt ssh.hash

Incremental Mode (Brute Force)

john --incremental hashes.txt

Resume a Session

john --restore=session_name

Hunting for Encrypted Files

Find common encrypted file types

for ext in $(echo ".xls .xls* .xltx .od* .doc .doc* .pdf .pot .pot* .pp*"); do
  echo -e "\nFile extension: " $ext
  find / -name *$ext 2>/dev/null | grep -v "lib\|fonts\|share\|core"
done

Find SSH private keys

grep -rnE '^\-{5}BEGIN [A-Z0-9]+ PRIVATE KEY\-{5}$' /* 2>/dev/null

Check if SSH key is encrypted

ssh-keygen -yf ~/.ssh/id_rsa
# If encrypted, prompts for passphrase

Cracking Protected Files

Crack Encrypted SSH Key

ssh2john.py SSH.private > ssh.hash
john --wordlist=rockyou.txt ssh.hash
john ssh.hash --show

Crack Office Document

office2john.py Protected.docx > protected-docx.hash
john --wordlist=rockyou.txt protected-docx.hash
john protected-docx.hash --show

Crack PDF File

pdf2john.py PDF.pdf > pdf.hash
john --wordlist=rockyou.txt pdf.hash
john pdf.hash --show

Cracking Protected Archives

Crack ZIP File

zip2john ZIP.zip > zip.hash
john --wordlist=rockyou.txt zip.hash
john zip.hash --show

Crack OpenSSL Encrypted GZIP

# Check file type
file GZIP.gzip
# Output: openssl enc'd data with salted password

# Brute-force with loop (errors expected, file extracts on success)
for i in $(cat rockyou.txt); do
  openssl enc -aes-256-cbc -d -in GZIP.gzip -k $i 2>/dev/null | tar xz
done

Crack BitLocker Drive

bitlocker2john -i Backup.vhd > backup.hashes
grep "bitlocker\$0" backup.hashes > backup.hash
john --wordlist=rockyou.txt backup.hash

The script outputs four hashes: the first two are for the password, the latter two for the recovery key. Focus on the password hash ($bitlocker$0$...).

Mounting BitLocker Drives (Linux)

# Install dislocker
sudo apt-get install dislocker

# Create mount points
sudo mkdir -p /media/bitlocker /media/bitlockermount

# Mount and decrypt
sudo losetup -f -P Backup.vhd
sudo dislocker /dev/loop0p2 -u<password> -- /media/bitlocker
sudo mount -o loop /media/bitlocker/dislocker-file /media/bitlockermount

# Unmount when done
sudo umount /media/bitlockermount
sudo umount /media/bitlocker