Hash Extraction

Hash Extraction Utilities

Before John can crack a password, you must extract the password hash from the file or system that stores it. John the Ripper Jumbo ships with a large collection of format-specific extraction tools — each ends in 2john and produces a plain-text hash file that John understands.

The general pattern is: tool2john <input_file> > output_hashes.txt. Then run john output_hashes.txt.

Commonly Used Extraction Tools

zip2johnZIP

Extract password hash from ZIP archives (traditional PKZIP or AES encrypted).

COMMANDzip2john secret.zip > zip_hash.txt

rar2johnRAR

Extract password hash from RAR archives (v3 and v5).

COMMANDrar2john secret.rar > rar_hash.txt

pdf2johnPDF

Extract password hash from PDF documents (40/128-bit RC4 or AES).

COMMANDpdf2john.pl document.pdf > pdf_hash.txt

ssh2johnSSH

Extract passphrase hash from SSH private keys (RSA, DSA, ECDSA, Ed25519).

COMMANDssh2john id_rsa > ssh_hash.txt

keepass2johnKeePass

Extract hash from KeePass databases (.kdb, .kdbx).

COMMANDkeepass2john database.kdbx > keepass_hash.txt

office2johnMS Office

Extract hash from MS Office documents (.doc, .docx, .xls, .xlsx, .ppt, .pptx).

COMMANDoffice2john document.docx > office_hash.txt

gpg2johnGPG

Extract hash from GPG/OpenPGP private keys.

COMMANDgpg2john private.asc > gpg_hash.txt

hccap2johnWPA/WPA2

Convert WPA/WPA2 handshake capture to crackable hash.

COMMANDhccap2john capture.hccap > wpa_hash.txt

bitcoin2johnBitcoin

Extract wallet encryption hash from Bitcoin wallet.dat.

COMMANDbitcoin2john wallet.dat > btc_hash.txt

7z2john7-Zip

Extract password hash from 7-Zip archives.

COMMAND7z2john archive.7z > sevenz_hash.txt

truecrypt2johnTrueCrypt

Extract hash from TrueCrypt/VeraCrypt volumes.

COMMANDtruecrypt2john volume.tc > tc_hash.txt

cvs2johnCVS pserver

Extract hash from CVS repository passfiles.

COMMANDcvs2john passfile > cvs_hash.txt

Full Example: ZIP File

Let us walk through cracking a password-protected ZIP archive from start to finish:

Step 1: Extract the hash

bash

1zip2john secret.zip > zip_hash.txt

The output is the PKZIP encrypted-hash string that John consumes.

Step 2: Inspect the hash

bash

1cat zip_hash.txt

You will see a line containing the file name inside, salt, and encrypted checksum — all in one.

Step 3: Crack with wordlist

bash

1john --wordlist=rockyou.txt zip_hash.txt

Step 4: View cracked password

bash

1john --show zip_hash.txt

Full Example: SSH Private Key

Extract from encrypted RSA key

bash

1ssh2john ~/.ssh/id_rsa > ssh_hash.txt

If your key has a passphrase, this extracts the encrypted blob for cracking.

Crack with rules (or incrementally if necessary)

bash

1john --wordlist=rockyou.txt --rules=Jumbo ssh_hash.txt

Show recovered passphrase

bash

1john --show ssh_hash.txt

Warning

If the SSH key is not encrypted or uses a new OpenSSH format, ssh2john may not extract anything. Ensure the key prompts for a passphrase on load.

Full Example: PDF Document

Extract PDF hash (older RC4 encryption)

bash

1pdf2john.pl document.pdf > pdf_hash.txt

Extract AES-encrypted PDF (newer files)

bash

1pdf2john.pl -s document.pdf > pdf_hash.txt

-s enables AES-256 support for newer Adobe versions.

Crack

bash

1john --wordlist=rockyou.txt --rules pdf_hash.txt

Tip

PDF passwords can be very slow if the file uses AES-256 encryption. Expect only a few hundred guesses per second on a CPU.

List All Available Extraction Tools

The 2john tools are scattered across /usr/share/john or in the source's run directory. List them:

List all 2john scripts in default path

bash

1ls /usr/share/john/*2john* 2>/dev/null || find . -name '*2john*'

From the John source directory

bash

1find ./run -name '*2john*' -type f | head -20

Info

Some extraction tools are actually Perl scripts (.pl), Python scripts (.py), or binary executables. Ensure you have the required interpreter installed (Perl, Python) if the tool complains.

Next: Command Builder Back