John the Ripper

John the Ripper is a free, open-source password cracking tool supporting many hash types and password formats. It's known for its flexibility, auto-detection capabilities, and extensive rule system.

Basic Usage

# Auto-detect hash type and crack
john hashes.txt

# Specify wordlist
john --wordlist=rockyou.txt hashes.txt

# Specify format explicitly
john --format=raw-md5 hashes.txt

# Show cracked passwords
john --show hashes.txt

Attack Modes

# Single crack mode (username mangling)
john --single hashes.txt

# Wordlist mode
john --wordlist=passwords.txt hashes.txt

# Incremental (brute force)
john --incremental hashes.txt

# Wordlist with rules
john --wordlist=passwords.txt --rules hashes.txt

Supported Formats

# List all formats
john --list=formats

# Common formats:
raw-md5, raw-sha1, raw-sha256
bcrypt, sha512crypt
nt (NTLM)
krb5tgs, krb5asrep

Hash File Format

# Standard format
user:hash

# Shadow file format
user:$6$salt$hash:...

# Pass hash directly
john --format=raw-md5 --stdin <<< "5f4dcc3b5aa765d61d8327deb882cf99"

Jumbo Version

John the Ripper "Jumbo" is the community-enhanced version with many additional formats and features beyond the core release.