Cracking Mode

Single Crack Mode

Single crack mode is John's fastest attack. It uses personal information from the login name (GECOS fields) — such as full name, home directory, shell, and other user account metadata — to generate a small set of candidate passwords for that specific user.

The mode applies simple transformations: reversing the name, appending numbers, capitalizing, swapping first/last name order, etc. Because it is tailored to each user's information and runs with minimal computational overhead, it often cracks passwords that dictionary attacks miss.

How Single Crack Works

John inspects each hash's associated username and GECOS field (which often contains the user's real name, office, phone, etc.) from the password file. It then generates passwords based on:

Full name (e.g., JohnDoe, doeJohn)
First name only
Last name only
Username variations
Reversed versions
Appended years (1980-2029)
Capitalization variations
Combined name + common suffixes

Tip

Single mode only needs a few seconds to minutes per hash, compared to hours or days for wordlist or incremental modes. Always run it first.

Usage

Basic Command

bash
1john --single hashes.txt

Single mode with specific format

bash
1john --single --format=sha512crypt hashes.txt

With session save

bash
1john --single --session=firstpass hashes.txt

Example Hash File with GECOS

John can extract user information from standard Unix password files. Here's how it generates candidates from user data:

Sample /etc/passwd entry

alice:$6$saltsalt$hash123...:1000:1000:Alice Smith,/home/alice,/bin/bash

GECOS field shows "Alice Smith" — John generates candidates like alice, Alice, Smith, aliceSmith, AliceSmith, smithAlice, etc.

When to Use Single Mode

1

First Pass

Always run --single at the start of any cracking session. It is almost free and often yields results.

2

User-Based Passwords

Organizations sometimes use standardized password templates like FirstNameYear (Alice2020) or FirstLast (AliceSmith). Single mode catches these.

3

CTF Challenges

CTF password hashes are often derived from usernames or names. Single mode cracks them in seconds.

4

Audit Baseline

Establish a quick baseline before committing significant compute resources.

Limitations

Only effective if users base passwords on their personal information.
May miss passwords unrelated to user identity (random strings, common wordlists).
Relies on GECOS fields being populated and useful.
Does not try large wordlists or complex mutations.

Info

Combine --single with --wordlist and --rules to leverage both personal info and large dictionary mutations.
Next: Wordlist Mode Back