John the Ripper Cheat Sheet

John the Ripper (JtR) — offline hash cracker. Pair with hashcat for GPU and hash-identifier/hashid for hash type.

Identify the Hash

• Identify hash type hashid '<hash>' (hash-identifier from THM/HackTricks)
• Common formats: MD5 $1$ (md5crypt), SHA256, bcrypt $2a$/$2b$, NTLM, Kerberos $krb5tgs$, ZIP/RAR $zip2$, SSH private $sshng$

Basic Cracking

• Simple dict attack john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
• Crack with default rules john --wordlist=rockyou.txt --rules hash.txt
• Specify format (if JtR can’t auto-detect) john --format=nt hash.txt
• Show cracked john --show hash.txt

Common Formats

• NTLM john --format=nt hash.txt --wordlist=rockyou.txt
• NTHash file from secretsdump/hashdump — same nt format
• bcrypt john --format=bcrypt hashes.txt
• SHA512crypt john --format=sha512crypt hashes.txt
• Kerberoast TGS john --format=krb5tgs hash.txt --wordlist=rockyou.txt
• AS-REP roast john --format=krb5asrep hash.txt
• ZIP zip2john file.zip > zip.hash && john zip.hash --wordlist=rockyou.txt
• RAR rar2john file.rar > rar.hash && john rar.hash
• PDF pdf2john file.pdf > pdf.hash && john pdf.hash
• KeePass keepass2john db.kdbx > kp.hash && john kp.hash
• Bitcoin wallet / SSH keys via ssh2john id_rsa > ssh.hash

Rule Based & CPU Tuning

• Show rules cheat: john --list=rules
• Selective ruleset john --rules=All --wordlist=rockyou.txt hash.txt
• Increase thread count john --fork=4 hash.txt (or -dev=cpu)
• Session control john --session=name hash.txt → john --restore=name

Incremental (mask-like brute force, slow)

• “Incremental” mode (charset-based) john --incremental hash.txt
• External/mask alternative (faster with GPU): use Hashcat masks.

Output & Config

• Show stats john --status
• Save to pot file (auto in ~/.john/john.pot)
• Modify wordlist per engagement pattern: prepend years/leetspeak via --rules and custom rules in john.conf.

Tips

• Try first letter capitalized, trailing digits rules: --rules=wordlist already includes some; add --mask mentally for Hashcat instead.
• For real-world AD: hash the NTLMv2 challenge from SMB relay capture, not NetNTLMv2 alone — or use secretsdump for LM/NTLM full hashes.