The Complete Guide to John the Ripper. Part 2: utilities for obtaining hashes

7 April 2023 4 minutes Author: Endpool

John the Ripper password cracking

John the Ripper is a fast password cracker currently available for many flavors of Unix, macOS, Windows, DOS, BeOS, and OpenVMS (the latter requires an additional patch). Its main purpose is to detect weak Unix passwords. John the Ripper is designed to be both versatile and fast. It combines multiple hacking modes into one program and is fully customizable to your specific needs (you can even define your own hacking mode using the built-in compiler that supports a subset of the C language). In addition, John is available for several different platforms, allowing you to use the same cracker everywhere (you can even continue a hacking session you started on another platform). Cracked passwords will be output to the terminal and stored in a file called $JOHN/john.pot (in the documentation and in the configuration file for John, “$JOHN” stands for John’s “home directory”; which directory it actually is depends on how you installed by John).

The $JOHN/john.pot file is also used to avoid downloading hashes of passwords you’ve already cracked the next time you run John. While hacking, you can press any status key, or ‘q’ or Ctrl-C to abort the session, saving its state to a file ($JOHN/john.rec by default). If you press Ctrl-C a second time before John has time to finish processing your first Ctrl-C, John will immediately terminate the session without saving. By default, the state is also saved every 10 minutes to allow recovery in the event of a failure. These are just the most essential things you can do with John.

How to crack John the Ripper password

John the Ripper can only crack hashes – he can’t directly work with encrypted files. The program cannot open, for example, an office document, enter a password there, etc. This is a solvable problem – we need to calculate (extract) the hash for the file we are interested in. John himself does not know how to do this. Support utilities are required. You can get acquainted with their list, for example, by typing the command:

This is what the list looks like on the machine where John was created from the original sources:

1password2john.py

7z2john.pl

adxcsouf2john.py

aem2john.py

aix2john.pl

aix2john.py

andotp2john.py

androidbackup2john.py

androidfde2john.py

ansible2john.py

apex2john.py

applenotes2john.py

aruba2john.py

atmail2john.pl

axcrypt2john.py

bestcrypt2john.py

bitcoin2john.py

bitlocker2john

bitlocker2john

bitwarden2john.py

bks2john.py

blockchain2john.py

ccache2john.py

cisco2john.pl

cisco2john.pl

cracf2john.py

dashlane2john.py

deepsound2john.py

diskcryptor2john.py

dmg2john

dmg2john.py

DPAPImk2john.py

eapmd5tojohn

ecryptfs2john.py

ejabberd2john.py

electrum2john.py

encfs2john.py

enpass2john.py

enpass5tojohn.py

ilezilla2john.py

geli2john.py

genincstats.rb

hccap2john

hccapx2john.py

hextoraw.pl

ibmiscanner2john.py

ikescan2john.py

ios7tojohn.pl

kdcdump2john.py

keepass2john

keychain2john.py

lastpass2john.py

ldif2john.pl

libreoffice2john.py

mac2john-alt.py

mac2john.py

mcafee_epo2john.py

neo2john.py

netntlm.pl

netscreen.py

office2john.py

openbsd_softraid2john.py

openssl2john.py

padlock2john.py

pcap2john.py

pdf2john.pl

racf2john

radius2john.pl

radius2john.py

sap2john.pl

signal2john.py

sipdump2john.py

telegram2john.py

test_tezos2john.py

tezos2john.py

uaf2john

vdi2john.pl

vmx2john.py

vncpcap2john

wpapcap2john

zip2john

Agree, the list is impressive!

On Kali Linux, these files are located in two directories:

script files in /usr/share/john/

and binary files in /usr/sbin/

In BlackArch, these files are located:

script files in the directory /usr/lib/john/

binaries in /usr/bin/