> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/cryptography/hashing/49.-john-the-ripper.md).

# 49. John the Ripper

## Overview

John the Ripper (JtR) is a classic password cracker with strong auto-detection and built-in format support. Great for Unix shadow files, zip passwords, and more.

## Installation

```bash
sudo apt install john

# Jumbo version (more formats)
sudo apt install john-jumbo
# or build from: https://github.com/openwall/john
```

## Basic Usage

```bash
# Auto-detect format and crack
john hash.txt

# With wordlist
john --wordlist=rockyou.txt hash.txt

# Show cracked passwords
john --show hash.txt

# List supported formats
john --list=formats
```

## Specify Format

```bash
john --format=raw-md5 hash.txt --wordlist=rockyou.txt
john --format=sha256crypt hash.txt --wordlist=rockyou.txt
john --format=bcrypt hash.txt --wordlist=rockyou.txt
john --format=NT hash.txt --wordlist=rockyou.txt
```

## Common Format Names

| Hash Type    | John Format     |
| ------------ | --------------- |
| MD5 (raw)    | `raw-md5`       |
| SHA-1        | `raw-sha1`      |
| SHA-256      | `raw-sha256`    |
| SHA-512      | `raw-sha512`    |
| bcrypt       | `bcrypt`        |
| NTLM         | `NT`            |
| Linux shadow | `sha512crypt`   |
| ZIP          | `pkzip` / `zip` |
| PDF          | `pdf`           |

## Extraction Tools (john-adjacent)

```bash
# Convert file passwords to John format
zip2john protected.zip > zip.hash
rar2john protected.rar > rar.hash
pdf2john protected.pdf > pdf.hash
ssh2john id_rsa > ssh.hash
keepass2john database.kdbx > keepass.hash

# Then crack
john --wordlist=rockyou.txt zip.hash
```

## Rules

```bash
# Use built-in rules
john --rules hash.txt --wordlist=rockyou.txt

# Specific rule set
john --rules=Jumbo hash.txt --wordlist=rockyou.txt
```

## Incremental (Brute Force)

```bash
john --incremental hash.txt
john --incremental=digits hash.txt   # digits only
john --incremental=alpha hash.txt    # letters only
```

## Restore / Continue Session

```bash
john --restore          # Resume last session
john --session=mysess hash.txt --wordlist=rockyou.txt
john --restore=mysess
```

## CTF Tips

* Start with `john hash.txt` — auto-detection is surprisingly good
* Use `zip2john`, `ssh2john`, etc. to handle protected files
* `--show` after cracking to display results
* John stores cracked passwords in `~/.john/john.pot`


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/cryptography/hashing/49.-john-the-ripper.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.