This article is Day 5 of a Kali Linux mastery course that provides a comprehensive tutorial on John the Ripper, an offline password hash cracking tool used in authorized penetration testing. It addresses the problem of recovering plaintext passwords from hashes found after gaining initial system access, such as those in /etc/shadow files, databases, or encrypted archives. The material matters because password hashes are commonly encountered during authorized security assessments, and understanding how to crack them offline is a fundamental penetration testing skill.
- Hash cracking as post-compromise activityThe article positions John the Ripper as a second-stage tool used after initial authorized access is gained through methods like Hydra exploits or other entry points. Once inside a system, testers often find password hashes in /etc/shadow, dumped databases, Windows SAM files, or locked archives—none of which are plaintext passwords, but can be converted to passwords through offline cracking at CPU speed without leaving traces on the target system.
- Automatic hash format detection capabilityJohn the Ripper automatically identifies hash formats from the hash string structure itself, recognizing MD5, SHA-1, SHA-512, NTLM, bcrypt, and hundreds of other formats without requiring manual specification. This automated detection reduces setup complexity and allows testers to begin cracking attempts immediately upon encountering unknown hash types.
- File converter family for archive extractionThe tool includes a family of built-in file converters—zip2john, rar2john, pdf2john, ssh2john, and keepass2john—that extract hashes from protected files and convert them into formats John can crack. This eliminates the need for manual hash extraction from encrypted archives, streamlining the entire cracking workflow.
- Multiple attack modes for different scenariosJohn the Ripper offers four distinct cracking modes: single crack (tests username variations), wordlist mode (dictionary attack using word lists like rockyou.txt), incremental mode (brute force all possible combinations), and rule-based cracking (applies mangling rules to dictionary words). Each mode addresses different password recovery scenarios based on available resources and time constraints.
- Rule-based attacks extend wordlist effectivenessThe article mentions rule-based cracking as a dedicated mode that combines wordlist entries with mangling rules, allowing targeted attacks that go beyond simple dictionary matching. This technique increases success rates against passwords that use common transformations of known words.
- Legal and ethical authorization requirementThe article explicitly states that all commands and techniques are restricted to authorized testing scenarios—hashes from your own lab VMs, Metasploitable2 systems, or practice hash files you create. Cracking hashes obtained without authorization is identified as illegal, establishing clear ethical boundaries for tool use.
- Long-term development and industry adoptionJohn the Ripper is described as one of the oldest and most widely used security tools still in active development, indicating its sustained relevance in penetration testing practice. The article also references a comparison with Hashcat, suggesting multiple specialized tools exist for different cracking scenarios.
Bottom line: John the Ripper is an essential offline password hash cracking tool for authorized penetration testers that automatically identifies hash formats, cracks multiple hash types through various attack modes, and includes converters for extracting hashes from common file types—all without leaving traces on target systems. Understanding when and how to apply its single crack, wordlist, incremental, and rule-based modes is fundamental to effective post-compromise password recovery in authorized securit
Day 180 — Advanced Kali Mastery
New to labs? → Ethical Hacking Lab Setup at Home · Metasploitable Labs Hub
What Is John the Ripper?
John the Ripper (JtR) is a free, open-source offline password hash cracker — one of the oldest and most widely used security tools still in active development. It takes password hashes (the stored representations of passwords, not the passwords themselves) and attempts to find the original plaintext by hashing candidate passwords and comparing results until a match is found.
Three things make John particularly useful for penetration testers:
/etc/shadow). Together they cover both sides of credential attacks.Identifying Hash Types — Before You Crack Anything
Before cracking a hash you need to know what type it is — the cracking algorithm depends entirely on the hash format. Hash formats have distinctive visual patterns you will learn to recognise, and Kali Linux ships with hash-identifier to automate this when you are unsure.
$1$salt$hash….. # MD5 (Linux crypt) — 22 chars after salt
$2y$10$salt..hash….. # bcrypt — very slow to crack
$5$salt$hash….. # SHA-256 (Linux)
$6$salt$hash……. # SHA-512 (Linux) — modern default
5f4dcc3b5aa765d61d8327deb882cf99 # MD5 — 32 hex chars
aad3b435b51404eeaad3b435b51404ee: # NTLM (Windows) — 32 hex chars with colon
da39a3ee5e6b4b0d3255bfef95601890afd80709 # SHA-1 — 40 hex chars
# ─── hash-identifier tool (interactive) ──────────────────────────
hash-identifier
HASH: 5f4dcc3b5aa765d61d8327deb882cf99
Possible Hashs:
[+] MD5
[+] Domain Cached Credentials – MD4(MD4(($pass)).(strtolower($username)))
# ─── List all John formats ────────────────────────────────────────
john –list=formats # full list (400+ formats)
john –list=formats | grep -i sha # filter for SHA variants
john –list=formats | grep -i ntlm # find NTLM format name
/etc/shadow Cracking — The Core Workflow
On Linux systems, user passwords are stored as hashes in /etc/shadow — readable only by root. After gaining root access to a system in an authorised penetration test, extracting and cracking these hashes is a standard post-exploitation step that demonstrates the full impact of weak passwords across all accounts on the system.
cat /etc/shadow on your Metasploitable2 VM.# Results stored in ~/.john/john.pot — persist between sessions
The 3 Cracking Modes — Choosing the Right Approach
Wordlist Mode in Depth — Choosing and Using Wordlists
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
# ─── Basic wordlist crack ─────────────────────────────────────────
john –wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
# ─── Specify format explicitly (when auto-detect fails) ──────────
john –wordlist=rockyou.txt –format=NT hashes.txt # NTLM
john –wordlist=rockyou.txt –format=sha512crypt hashes.txt # SHA-512
john –wordlist=rockyou.txt –format=md5crypt hashes.txt # MD5 Linux
john –wordlist=rockyou.txt –format=bcrypt hashes.txt # bcrypt
# ─── Create a practice hash file yourself ────────────────────────
echo -n “password123” | md5sum # make an MD5 hash
482c811da5d5b4bc6d497ffa98491e38 ← paste this into test.txt
john –wordlist=rockyou.txt –format=Raw-MD5 test.txt # crack it
echo -n "yourword" | md5sum or sha256sum. Paste the hash into a text file. Crack it with John. This lets you test every mode and format without needing a lab VM ready. You know the answer before you start — perfect for learning. See also: Password Cracking Explained and How Hackers Crack Passwords in Seconds.Rule-Based Cracking — The Biggest Coverage Multiplier
Rules are the most underused feature in John the Ripper. A rule takes each word from your wordlist and generates dozens of variations — capitalisation patterns, number appending, l33t substitutions, prefix/suffix additions. A 14-million-word rockyou.txt with --rules effectively tests hundreds of millions of password candidates, covering the most common real-world password creation patterns.
# Input word: “password”
password → password, Password, PASSWORD, password1, password!
→ p@ssword, passw0rd, p@ssw0rd, Password123, password2024
→ drowssap (reversed), Password! Password@ Password#
# ─── Run wordlist + default rules ────────────────────────────────
john –wordlist=rockyou.txt –rules hashes.txt
# ─── Run wordlist + Jumbo rules (more thorough) ──────────────────
john –wordlist=rockyou.txt –rules=Jumbo hashes.txt
# ─── Run wordlist + KoreLogic rules (comprehensive) ──────────────
john –wordlist=rockyou.txt –rules=KoreLogicRules hashes.txt
# ─── View which rules are available ──────────────────────────────
john –list=rules
File Password Cracking — zip2john, rar2john, pdf2john & More
The *2john utilities extract the password hash from a protected file so John can crack it. This family of tools covers almost every common password-protected file format encountered in penetration testing.
echo “secret data” > secret.txt
zip -e protected.zip secret.txt # set password: “iloveyou”
# Extract the hash:
zip2john protected.zip > zip_hash.txt
# Crack it:
john –wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt
# Show result:
john –show zip_hash.txt
protected.zip:iloveyou::protected.zip:secret.txt:protected.zip
Sessions, Show & Restore — Managing Long Cracks
john –wordlist=rockyou.txt –session=mycrack hashes.txt
# CTRL+C to pause · resume with:
john –restore=mycrack
# ─── Show all cracked passwords ───────────────────────────────────
john –show hashes.txt
john –show –format=NT hashes.txt # specify format if needed
# ─── View the crack pot (all previously cracked) ─────────────────
cat ~/.john/john.pot
# Results persist here — won’t retry already-cracked hashes
# ─── Check progress during a running crack ────────────────────────
# Press any key during a john run to see status:
1234p 0:00:00:30 3% (ETA: 10:23:42) 41.1p/s “dragon”
# 1234 passwords tried, 30 sec elapsed, 3% done, 41 per second
John the Ripper vs Hashcat — When to Use Each
| Aspect | John the Ripper | Hashcat |
|---|---|---|
| Processing | CPU-based | GPU-based — 10–100× faster |
| Format detection | Automatic | Manual (-m flag with number) |
| File converters | Built-in (zip2john, pdf2john…) | None (use john’s converters) |
| Ease of use | Simpler — auto-detects, fewer flags | More flags, steeper learning curve |
| Best for | Learning, small hash sets, file passwords | Large hash files, production cracking |
| In pentest order | First — learn here, quick wins | Scale up — when John is too slow |
📋 John the Ripper Command Reference Card
john –wordlist=rockyou.txt c.txt
john –show c.txt
john –wordlist=rockyou.txt –rules hashes.txt
john –incremental=Digits hashes.txt
rar2john file.rar > hash.txt
pdf2john file.pdf > hash.txt
ssh2john id_rsa > hash.txt
john –restore=name
john –show hashes.txt
cat ~/.john/john.pot
–format=sha512crypt # Linux SHA-512
–format=md5crypt # Linux MD5
–format=Raw-MD5 # plain MD5
john –list=formats
john –list=formats | grep sha
Frequently Asked Questions – John the Ripper Tutorial
Password cracking is where penetration testing stops being theoretical and becomes real. When John cracks sys:batman from a production server’s shadow file in under 30 seconds, the conversation in the debriefing room changes. The remediation is not technical — it is cultural. Strong, unique passwords enforced by policy and checked against breach databases. John the Ripper does not create that problem. It makes the problem visible. That is the value of learning to use it properly in an authorised context.
