Real-World Usage

Examples

A collection of common John the Ripper commands for real-world password cracking scenarios. Each example shows how to handle a specific hash type and which mode is most effective.

1

Crack Unix /etc/shadow entry (sha512crypt)

Most common: shadow file entry. After extracting with unshadow, use --format=sha512crypt.

bash
1john --wordlist=rockyou.txt --rules --format=sha512crypt hashes.txt

Note: Extract with: unshadow /etc/passwd /etc/shadow > hashes.txt

2

Crack Windows NTLM hash dump

From mimikatz, secretsdump, or ntlmssp capture. Auto-detect format typically works without --format=NT.

bash
1john --wordlist=rockyou.txt --rules ntlm_hashes.txt

Note: NTLM is fast: billions/sec with GPU.

3

Crack captured WPA/WPA2 PSK handshake

Convert .pcap with hccapx (aircrack-ng tools) or hcxpcapngtool, then crack.

bash
1john --wordlist=rockyou.txt --rules --format=hccapx capture.hccapx

Note: WPA2 is intentionally slow (~500-1000 guesses/sec CPU).

4

Extract + crack ZIP password

Two-step: extract PKZIP hash, then crack.

bash
1zip2john archive.zip > zip_hash.txt
2john --wordlist=rockyou.txt zip_hash.txt

Note: ZIP crypto is weak; millions/sec possible.

5

Extract + crack RAR archive

RAR v3 and v5 supported; v5 is much slower.

bash
1rar2john secret.rar > rar_hash.txt
2john --wordlist=rockyou.txt rar_hash.txt

Note: RAR5 uses AES; expect <100 guesses/sec on CPU.

6

Crack encrypted PDF

Older PDFs use RC4 (faster); newer use AES (slower).

bash
1pdf2john.pl document.pdf > pdf_hash.txt
2john --wordlist=rockyou.txt pdf_hash.txt

Note: Add -s for AES support if pdf2john complains.

7

Crack SSH private key passphrase

Only works if the key was encrypted with a passphrase.

bash
1ssh2john id_rsa > ssh_hash.txt
2john --wordlist=rockyou.txt ssh_hash.txt

Note: SSH key types: RSA, DSA, ECDSA, Ed25519 all supported.

8

Crack KeePass database

KeePass 1.x (.kdb) and 2.x (.kdbx) supported.

bash
1keepass2john database.kdbx > kp_hash.txt
2john --wordlist=rockyou.txt kp_hash.txt

Note: Very slow — AES + many rounds. Expect hundreds/sec.

9

GPU-accelerated md5crypt cracking

If John was built with OpenCL, use -opencl variants for GPU.

bash
1john --format=md5crypt-opencl --wordlist=rockyou.txt hashes.txt

Note: Benchmark: john --format=md5crypt-opencl --test

10

Crack with incremental after wordlist fails

Wordlist first, then fallback to brute force. Handy for remaining hashes.

bash
1john --wordlist=rockyou.txt --incremental hashes.txt

Note: Warning: incremental is extremely slow beyond 7 characters.

11

Crack with custom rules file

Create a .rules file in ~/.john/john.conf or current directory.

bash
1john --wordlist=rockyou.txt --rules=OfficeRules hashes.txt

Note: Rule syntax: one operation per line; see doc/RULES in source.

12

Single crack mode first pass

Always run this first — it is fast and often cracks many hashes immediately.

bash
1john --single hashes.txt

Note: Works best on hashes with username/gecos accessible.

13

Restore interrupted session

Resume a stopped/cancelled cracking session.

bash
1john --restore=crack_session

Note: Use --session=name to save session on initial run.

14

Multi-core parallel cracking

Spaunches 4 John processes; distributes hash space across CPU cores.

bash
1john --fork=4 --wordlist=rockyou.txt hashes.txt

Note: Do not exceed core count; diminishing returns beyond cores.

15

Crack WEP WiFi key (not WPA)

WEP uses RC4 with known IVs; much faster than WPA.

bash
1john --format=wep --incremental=ASCII wep_hash.txt

Note: Obtain .hccap/.pcap with aireplay-ng, convert with aircrack tools.

16

Show cracked passwords only

Lists cracked passwords along with the hash, leaving uncracked ones untouched.

bash
1john --show hashes.txt

Note: To see only cracked: john --show --format=... hashes.txt

17

Limit password length (incremental)

Practical for short PIN codes or 6-character alphanumeric.

bash
1john --incremental --max-length=6 --format=raw-md5 hashes.txt

Note: 6 lowercase = 308 million combinations; ~10 min at 500k p/s.

18

Crack Bitcoin wallet

Bitcoin Core wallet.dat uses SHA256 encryption of passphrase.

bash
1bitcoin2john wallet.dat > btc_hash.txt
2john --wordlist=rockyou.txt btc_hash.txt

Note: wallet.dat must be unencrypted wallet version prior to v2.

19

Squid proxy digest auth

Apache apr1 (MD5) format for HTTP Digest or Squid proxy.

bash
1john --format=md5-apr --wordlist=rockyou.txt squid_hashes.txt

Note: Also works for many legacy web apps.

20

Crack with multiple wordlists

Sequential: tries all words from first, then second, then third list.

bash
1john --wordlist=rockyou.txt --wordlist=common.txt --wordlist=employees.txt hashes.txt

Note: No priority; you can order lists by likelihood to be efficient.

Extraction Strategy Cheatsheet

Match the file type to the right extraction tool:

zip2john

ZIP archive

work on all ZIP encryption types

rar2john

RAR archive

RAR v3 and v5 both supported

pdf2john.pl

PDF document

add -s flag for AES PDFs

ssh2john

SSH private key

works for RSA/DSA/ECDSA/Ed25519

keepass2john

KeePass DB

both .kdb and .kdbx

office2john

Office file

doc/xls/ppt old and new

hccap2john

WPA handshake

convert .pcap to .hccapx first

gpg2john

GPG key

encrypted private keys only

bitcoin2john

Bitcoin wallet

wallet.dat (old format)

Next: Pro Tips Back