Monty's Pentesting Notes | Obsidian

    John The Ripper

    Table of Contents

    Single Crack Mode

    john --format=<hash_type> <hash or hash_file>

    we can check the progress by running the john --show command

    Cracking with John

    Hash FormatExample CommandDescription
    afsjohn --format=afs hashes_to_crack.txtAFS (Andrew File System) password hashes
    bfeggjohn --format=bfegg hashes_to_crack.txtbfegg hashes used in Eggdrop IRC bots
    bfjohn --format=bf hashes_to_crack.txtBlowfish-based crypt(3) hashes
    bsdijohn --format=bsdi hashes_to_crack.txtBSDi crypt(3) hashes
    crypt(3)john --format=crypt hashes_to_crack.txtTraditional Unix crypt(3) hashes
    desjohn --format=des hashes_to_crack.txtTraditional DES-based crypt(3) hashes
    dmd5john --format=dmd5 hashes_to_crack.txtDMD5 (Dragonfly BSD MD5) password hashes
    dominosecjohn --format=dominosec hashes_to_crack.txtIBM Lotus Domino 6/7 password hashes
    EPiServer SID hashesjohn --format=episerver hashes_to_crack.txtEPiServer SID (Security Identifier) password hashes
    hdaajohn --format=hdaa hashes_to_crack.txthdaa password hashes used in Openwall GNU/Linux
    hmac-md5john --format=hmac-md5 hashes_to_crack.txthmac-md5 password hashes
    hmailserverjohn --format=hmailserver hashes_to_crack.txthmailserver password hashes
    ipb2john --format=ipb2 hashes_to_crack.txtInvision Power Board 2 password hashes
    krb4john --format=krb4 hashes_to_crack.txtKerberos 4 password hashes
    krb5john --format=krb5 hashes_to_crack.txtKerberos 5 password hashes
    LMjohn --format=LM hashes_to_crack.txtLM (Lan Manager) password hashes
    lotus5john --format=lotus5 hashes_to_crack.txtLotus Notes/Domino 5 password hashes
    mscashjohn --format=mscash hashes_to_crack.txtMS Cache password hashes
    mscash2john --format=mscash2 hashes_to_crack.txtMS Cache v2 password hashes
    mschapv2john --format=mschapv2 hashes_to_crack.txtMS CHAP v2 password hashes
    mskrb5john --format=mskrb5 hashes_to_crack.txtMS Kerberos 5 password hashes
    mssql05john --format=mssql05 hashes_to_crack.txtMS SQL 2005 password hashes
    mssqljohn --format=mssql hashes_to_crack.txtMS SQL password hashes
    mysql-fastjohn --format=mysql-fast hashes_to_crack.txtMySQL fast password hashes
    mysqljohn --format=mysql hashes_to_crack.txtMySQL password hashes
    mysql-sha1john --format=mysql-sha1 hashes_to_crack.txtMySQL SHA1 password hashes
    NETLMjohn --format=netlm hashes_to_crack.txtNETLM (NT LAN Manager) password hashes
    NETLMv2john --format=netlmv2 hashes_to_crack.txtNETLMv2 (NT LAN Manager version 2) password hashes
    NETNTLMjohn --format=netntlm hashes_to_crack.txtNETNTLM (NT LAN Manager) password hashes
    NETNTLMv2john --format=netntlmv2 hashes_to_crack.txtNETNTLMv2 (NT LAN Manager version 2) password hashes
    NEThalfLMjohn --format=nethalflm hashes_to_crack.txtNEThalfLM (NT LAN Manager) password hashes
    md5nsjohn --format=md5ns hashes_to_crack.txtmd5ns (MD5 namespace) password hashes
    nsldapjohn --format=nsldap hashes_to_crack.txtnsldap (OpenLDAP SHA) password hashes
    sshajohn --format=ssha hashes_to_crack.txtssha (Salted SHA) password hashes
    NTjohn --format=nt hashes_to_crack.txtNT (Windows NT) password hashes
    opensshajohn --format=openssha hashes_to_crack.txtOPENSSH private key password hashes
    oracle11john --format=oracle11 hashes_to_crack.txtOracle 11 password hashes
    oraclejohn --format=oracle hashes_to_crack.txtOracle password hashes
    pdfjohn --format=pdf hashes_to_crack.txtPDF (Portable Document Format) password hashes
    phpass-md5john --format=phpass-md5 hashes_to_crack.txtPHPass-MD5 (Portable PHP password hashing framework) password hashes
    phpsjohn --format=phps hashes_to_crack.txtPHPS password hashes
    pix-md5john --format=pix-md5 hashes_to_crack.txtCisco PIX MD5 password hashes
    pojohn --format=po hashes_to_crack.txtPo (Sybase SQL Anywhere) password hashes
    rarjohn --format=rar hashes_to_crack.txtRAR (WinRAR) password hashes
    raw-md4john --format=raw-md4 hashes_to_crack.txtRaw MD4 password hashes
    raw-md5john --format=raw-md5 hashes_to_crack.txtRaw MD5 password hashes
    raw-md5-unicodejohn --format=raw-md5-unicode hashes_to_crack.txtRaw MD5 Unicode password hashes
    raw-sha1john --format=raw-sha1 hashes_to_crack.txtRaw SHA1 password hashes
    raw-sha224john --format=raw-sha224 hashes_to_crack.txtRaw SHA224 password hashes
    raw-sha256john --format=raw-sha256 hashes_to_crack.txtRaw SHA256 password hashes
    raw-sha384john --format=raw-sha384 hashes_to_crack.txtRaw SHA384 password hashes
    raw-sha512john --format=raw-sha512 hashes_to_crack.txtRaw SHA512 password hashes
    salted-shajohn --format=salted-sha hashes_to_crack.txtSalted SHA password hashes
    sapbjohn --format=sapb hashes_to_crack.txtSAP CODVN B (BCODE) password hashes
    sapgjohn --format=sapg hashes_to_crack.txtSAP CODVN G (PASSCODE) password hashes
    sha1-genjohn --format=sha1-gen hashes_to_crack.txtGeneric SHA1 password hashes
    skeyjohn --format=skey hashes_to_crack.txtS/Key (One-time password) hashes
    sshjohn --format=ssh hashes_to_crack.txtSSH (Secure Shell) password hashes
    sybaseasejohn --format=sybasease hashes_to_crack.txtSybase ASE password hashes
    xshajohn --format=xsha hashes_to_crack.txtxsha (Extended SHA) password hashes
    zipjohn --format=zip hashes_to_crack.txtZIP (WinZip) password hashes

    Wordlist Mode (Dictionary Attack)

    john --wordlist=<wordlist_file> --rules <hash_file>

    Incremental Mode

    the most time consuming, starting from 1 single char to more..

    john --incremental <hash_file>

    Cracking Files

    > <tool> <file_to_crack> > file.hash
> pdf2john server_doc.pdf > server_doc.hash
> john server_doc.hash
                # OR
> john --wordlist=<wordlist.txt> server_doc.hash
    ToolDescription
    pdf2johnConverts PDF documents for John
    ssh2johnConverts SSH private keys for John
    mscash2johnConverts MS Cash hashes for John
    keychain2johnConverts OS X keychain files for John
    rar2johnConverts RAR archives for John
    pfx2johnConverts PKCS#12 files for John
    truecrypt_volume2johnConverts TrueCrypt volumes for John
    keepass2johnConverts KeePass databases for John
    vncpcap2johnConverts VNC PCAP files for John
    putty2johnConverts PuTTY private keys for John
    zip2johnConverts ZIP archives for John
    hccap2johnConverts WPA/WPA2 handshake captures for John
    office2johnConverts MS Office documents for John
    wpa2johnConverts WPA/WPA2 handshakes for John
    > locate *2john*

/usr/bin/bitlocker2john
/usr/bin/dmg2john
/usr/bin/gpg2john
/usr/bin/hccap2john
/usr/bin/keepass2john
/usr/bin/putty2john
/usr/bin/racf2john
/usr/bin/rar2john
/usr/bin/uaf2john
/usr/bin/vncpcap2john
/usr/bin/wlanhcx2john
/usr/bin/wpapcap2john
...