John the Ripper Tutorial and Tips

John the Ripper is an old school hacker tool. It has been around since the early days of Unix based systems and was always the go to tool for cracking passwords. When you needed to recover passwords from /etc/passwd or /etc/shadow in more modern *nix systems, JTR was always ready to roll.

When thinking of current password breaking technology the you must think about GPU support. The default version of John the Ripper does not come with GPU support, however there are community builds known as the jumbo patch available that contain the additional code for GPU support as well as a larger number of supported hash types.

How to use John The Ripper to Recover Passwords

Generally John expects to receive password hashes in the form user:hash in a plain text file. When run against a file in this format John The Ripper does a pretty good job at identifying the hash type and beginning to try and break it.

user@test:~/john/run/$./john mypasswordfile.txt

It is literally as simple as that, this uses the default password recovery mode as well as the default word list or dictionary.

Of course there are many more options available when running JTR, here is the command line help:

John the Ripper password cracker, version 1.8.0-jumbo-1_omp [linux-gnu 64-bit AVX2-autoconf]
Copyright (c) 1996-2014 by Solar Designer and others
Homepage: http://www.openwall.com/john/

Usage: john [OPTIONS] [PASSWORD-FILES]
--single[=SECTION]        "single crack" mode
--wordlist[=FILE] --stdin wordlist mode, read words from FILE or stdin
                  --pipe  like --stdin, but bulk reads, and allows rules
--loopback[=FILE]         like --wordlist, but fetch words from a .pot file
--dupe-suppression        suppress all dupes in wordlist (and force preload)
--encoding=NAME           input encoding (eg. UTF-8, ISO-8859-1). See also
                          doc/ENCODING and --list=hidden-options.
--rules[=SECTION]         enable word mangling rules for wordlist modes
--incremental[=MODE]      "incremental" mode [using section MODE]
--mask=MASK               mask mode using MASK
--markov[=OPTIONS]        "Markov" mode (see doc/MARKOV)
--external=MODE           external mode or word filter
--stdout[=LENGTH]         just output candidate passwords [cut at LENGTH]
--restore[=NAME]          restore an interrupted session [called NAME]
--session=NAME            give a new session the NAME
--status[=NAME]           print status of a session [called NAME]
--make-charset=FILE       make a charset file. It will be overwritten
--show[=LEFT]             show cracked passwords [if =LEFT, then uncracked]
--test[=TIME]             run tests and benchmarks for TIME seconds each
--users=[-]LOGIN|UID[,..] [do not] load this (these) user(s) only
--groups=[-]GID[,..]      load users [not] of this (these) group(s) only
--shells=[-]SHELL[,..]    load users with[out] this (these) shell(s) only
--salts=[-]COUNT[:MAX]    load salts with[out] COUNT [to MAX] hashes
--save-memory=LEVEL       enable memory saving, at LEVEL 1..3
--node=MIN[-MAX]/TOTAL    this node's number range out of TOTAL count
--fork=N                  fork N processes
--pot=NAME                pot file to use
--list=WHAT               list capabilities, see --list=help or doc/OPTIONS
--format=NAME             force hash type NAME: 7z AFS agilekeychain aix-smd5
                          aix-ssha1 aix-ssha256 aix-ssha512 asa-md5 bcrypt
                          bfegg Bitcoin blackberry-es10 Blockchain bsdicrypt
                          chap Citrix_NS10 Clipperz cloudkeychain cq CRC32
                          crypt dahua descrypt Django django-scrypt dmd5 dmg
                          dominosec dragonfly3-32 dragonfly3-64 dragonfly4-32
                          dragonfly4-64 Drupal7 dummy dynamic_n eCryptfs EFS
                          eigrp EncFS EPI EPiServer fde FormSpring Fortigate
                          gost gpg HAVAL-128-4 HAVAL-256-3 hdaa HMAC-MD5
                          HMAC-SHA1 HMAC-SHA224 HMAC-SHA256 HMAC-SHA384
                          HMAC-SHA512 hMailServer hsrp IKE ipb2 KeePass
                          keychain keyring keystore known_hosts krb4 krb5
                          krb5-18 krb5pa-md5 krb5pa-sha1 kwallet LastPass LM
                          lotus5 lotus85 LUKS MD2 md4-gen md5crypt md5ns mdc2
                          MediaWiki MongoDB Mozilla mscash mscash2 MSCHAPv2
                          mschapv2-naive mssql mssql05 mssql12 mysql mysql-sha1
                          mysqlna net-md5 net-sha1 nethalflm netlm netlmv2
                          netntlm netntlm-naive netntlmv2 nk nsldap NT nt2
                          o5logon ODF Office oldoffice OpenBSD-SoftRAID
                          openssl-enc OpenVMS oracle oracle11 osc Panama
                          PBKDF2-HMAC-SHA1 PBKDF2-HMAC-SHA256
                          PBKDF2-HMAC-SHA512 PDF PFX phpass PHPS pix-md5 PKZIP
                          po postgres PST PuTTY pwsafe RACF RAdmin RAKP rar
                          RAR5 Raw-Blake2 Raw-Keccak Raw-Keccak-256 Raw-MD4
                          Raw-MD5 Raw-MD5u Raw-SHA Raw-SHA1 Raw-SHA1-Linkedin
                          Raw-SHA1-ng Raw-SHA224 Raw-SHA256 Raw-SHA256-ng
                          Raw-SHA384 Raw-SHA512 Raw-SHA512-ng ripemd-128
                          ripemd-160 rsvp Salted-SHA1 sapb sapg scrypt sha1-gen
                          sha1crypt sha256crypt sha512crypt Siemens-S7 SIP
                          skein-256 skein-512 skey Snefru-128 Snefru-256 SSH
                          SSH-ng SSHA512 STRIP SunMD5 sxc Sybase-PROP sybasease
                          tc_aes_xts tc_ripemd160 tc_sha512 tc_whirlpool
                          tcp-md5 Tiger tripcode VNC vtp wbb3 whirlpool
                          whirlpool0 whirlpool1 WoWSRP wpapsk xsha xsha512 ZIP
            

In this command line help, we can see there are a large number of hash types that JTR is able to have a go at cracking. This help is from the Jumbo Patch version of John the Ripper hence the large number of available hash types.