John the Ripper cheatsheet

# Explicit format (avoids mis-detection)
john --format=NT hashes.txt --wordlist=rockyou.txt
john --format=bcrypt hashes.txt --wordlist=rockyou.txt
john --format=netntlmv2 --wordlist=rockyou.txt hashes.txt
john --format=krb5tgs --wordlist=rockyou.txt spn_hashes.txt
john --format=krb5asrep --wordlist=rockyou.txt asrep_hashes.txt

# WPA requires ESSID embedded (use hcxtools or wpapcap2john)
john --format=wpapsk --wordlist=rockyou.txt wpa.hash

# List all formats
john --list=formats
john --list=formats | grep -i kerberos
john --list=formats | grep -i opencl

# Basic wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Wordlist with default rules
john --wordlist=rockyou.txt --rules hashes.txt

# Named rulesets
john --wordlist=rockyou.txt --rules=Best64 hashes.txt
john --wordlist=rockyou.txt --rules=Jumbo hashes.txt
john --wordlist=rockyou.txt --rules=KoreLogic hashes.txt
john --wordlist=rockyou.txt --rules=All hashes.txt

# Combine multiple wordlists via stdin
cat list1.txt list2.txt | john --stdin --rules hashes.txt

# Deduplicate a wordlist first
john --wordlist=combined.txt --stdout | unique cleaned.txt

Uses login names, GECOS fields, and home directory info to generate candidates. Run this first - it is the fastest mode.

john --single hashes.txt
john --single --format=raw-md5 hashes.txt

# Feed username:hash format for best results
john --single --format=NT user_ntlm.txt
# File format: username:hash
# echo "alice:5f4dcc3b..." >> targets.txt

# Full ASCII brute force (all printable)
john --incremental hashes.txt

# Charset modes
john --incremental=ASCII hashes.txt    # all printable ASCII
john --incremental=Alnum hashes.txt   # a-z A-Z 0-9
john --incremental=Alpha hashes.txt   # a-z A-Z
john --incremental=Lower hashes.txt   # a-z only
john --incremental=Upper hashes.txt   # A-Z only
john --incremental=Digits hashes.txt  # 0-9 only

# Limit length range
john --incremental=Alnum --min-length=6 --max-length=8 hashes.txt

# Use a pre-defined external mode from john.conf
john --external=double hashes.txt
john --external=Strip hashes.txt

# External as a word filter (filter mode)
john --wordlist=rockyou.txt --external=Uppercase hashes.txt

# 1. Single mode (account metadata - username mangling)
john --single --format=<format> hashes.txt

# 2. Wordlist baseline (no rules)
john --wordlist=rockyou.txt --format=<format> hashes.txt

# 3. Wordlist + Best64 (fast, high yield)
john --wordlist=rockyou.txt --rules=Best64 --format=<format> hashes.txt

# 4. Wordlist + KoreLogic (medium, broader coverage)
john --wordlist=rockyou.txt --rules=KoreLogic --format=<format> hashes.txt

# 5. Wordlist + Jumbo (slow, extensive mutations)
john --wordlist=rockyou.txt --rules=Jumbo --format=<format> hashes.txt

# 6. Mask attack (known pattern, e.g. Season+Year)
john --mask='?u?l?l?l?l?l?d?d?d?d' --format=<format> hashes.txt

# 7. Incremental (brute force - fast hashes only)
john --incremental=Alnum --format=<format> hashes.txt

Add custom rules to /etc/john/john.conf or ~/.john/john.conf under a named section:

# Corporate password policy: Word + Year (e.g., Summer2024)
[List.Rules:Corporate]
# Capitalize + append 4-digit years 2020-2024
c$2$0$2$[0-4]
# Capitalize + append year + !
c$2$0$2$[0-4]$!
# Capitalize + append season + year
# (use wordlist with seasons, append digits)
c Az"20" $[0-9] $[0-9]

# Leet-speak + number suffix
[List.Rules:L33t]
s a@ s e3 s o0 s i! $[0-9]
sa@ se3 so0 si! $[0-9] $[0-9]

# Common corporate patterns: Word+Number+Symbol
[List.Rules:CorpSuffix]
c $[0-9] $[0-9] $!
c $[0-9] $[0-9] $[0-9] $!
c Az"!" $[0-9] $[0-9]

# Use custom rule from john.conf
john --wordlist=seasons.txt --rules=Corporate hashes.txt
john --wordlist=company_words.txt --rules=CorpSuffix hashes.txt

# Generate wordlist candidates to stdout (for piping/testing)
john --wordlist=rockyou.txt --rules=Corporate --stdout | head -20
john --wordlist=rockyou.txt --rules=KoreLogic --stdout | wc -l

# /etc/john/john.conf  -- add under [List.Rules:SeasonYear]
[List.Rules:SeasonYear]
# append 2-digit year range 20-24
c $2 $[0-4]
c $2 $[0-4] $!
# append 4-digit year
c Az"20" $[2-4]
c Az"20" $[2-4] $!
# e.g. Summer2023, Winter2022!, Spring2024

# Create seasons wordlist
echo -e "Spring\nSummer\nFall\nWinter\nAutumn\nJanuary\nFebruary\nMarch\nApril\nMay\nJune\nJuly\nAugust\nSeptember\nOctober\nNovember\nDecember" > seasons.txt

john --wordlist=seasons.txt --rules=SeasonYear hashes.txt

# Company name + number pattern
echo "CompanyName" > company.txt
john --wordlist=company.txt --rules=CorpSuffix hashes.txt

# Output candidates to stdout (for piping to other tools)
john --wordlist=rockyou.txt --rules=Best64 --stdout
john --wordlist=rockyou.txt --rules=KoreLogic --stdout | wc -l

# Pipe directly into hashcat
john --wordlist=rockyou.txt --rules=Best64 --stdout | \
  hashcat -m 1000 hashes.txt -

# Generate incremental candidates to file
john --incremental=Alnum --stdout --max-length=6 > alnum6.txt

# Mask to stdout
john --mask='?u?l?l?l?d?d?d?d' --stdout > mask_candidates.txt

# Remove duplicates from wordlist (john built-in)
john --wordlist=combined.txt --stdout | unique deduped.txt

# Make a charset file from a sample (for incremental mode)
john --make-charset=custom.chr

# Reference custom charset in john.conf:
# [Incremental:Custom]
# File = $JOHN/custom.chr
# MinLen = 6
# MaxLen = 10
# CharCount = 62

# Sort wordlist for optimal performance with salted hashes
sort wordlist.txt > sorted_wordlist.txt

# Merge and dedup multiple wordlists
cat rockyou.txt custom.txt | sort -u | unique merged.txt

# Filter to a specific length
john --wordlist=rockyou.txt --stdout --min-length=8 --max-length=12 > filtered.txt

# Pipe crunch candidates directly (install crunch)
crunch 8 10 abcdefghijklmnopqrstuvwxyz0123456789 | john --stdin hashes.txt

# Use cewl to generate target-specific wordlist
cewl -d 3 -m 5 https://target.com -w target_words.txt
john --wordlist=target_words.txt --rules=KoreLogic hashes.txt

# Start named session (automatically resumable)
john --session=corp_ntlm --wordlist=rockyou.txt hashes.txt

# Restore interrupted session
john --restore=corp_ntlm

# Restore default session
john --restore

# Check status of running session (send SIGUSR1 or use flag)
john --status=corp_ntlm
# Or press 'q' / send signal to running john process:
kill -USR1 $(pgrep john)

# List session/pot files
ls ~/.john/
# john.pot  -- all cracked hashes (persistent)
# *.rec     -- session recovery files

# Use alternate pot file (avoid polluting main pot)
john --pot=./ctf.pot --wordlist=rockyou.txt hashes.txt
john --show --pot=./ctf.pot hashes.txt

# Show all cracked passwords
john --show hashes.txt

# Show cracked for specific format
john --show --format=NT hashes.txt

# Show remaining (not yet cracked)
john --show=left hashes.txt

# Count cracked vs total
john --show hashes.txt 2>&1 | tail -1

# Output to file (redirect)
john --show hashes.txt > cracked.txt

# Fork N processes (uses N CPU cores)
john --wordlist=rockyou.txt --fork=4 hashes.txt
john --wordlist=rockyou.txt --rules --fork=$(nproc) hashes.txt

# OpenMP (built-in parallelism for some formats)
# Enabled by default if john compiled with OpenMP
OMP_NUM_THREADS=8 john --wordlist=rockyou.txt hashes.txt

# Save memory when cracking large hash files
john --save-memory=1 hashes.txt   # some tables not preloaded
john --save-memory=2 hashes.txt   # more savings, slower
john --save-memory=3 hashes.txt   # maximum savings

# Limit run time (useful in scripts)
john --max-run-time=3600 --wordlist=rockyou.txt hashes.txt

# Target specific cost (filter hard hashes out)
john --costs=t=10..12 --wordlist=rockyou.txt hashes.txt

# Split work across M machines (node M of N total)
# Machine 1 of 4:
john --node=1/4 --wordlist=rockyou.txt hashes.txt
# Machine 2 of 4:
john --node=2/4 --wordlist=rockyou.txt hashes.txt
# Machine 3 of 4:
john --node=3/4 --wordlist=rockyou.txt hashes.txt
# Machine 4 of 4:
john --node=4/4 --wordlist=rockyou.txt hashes.txt

# Range of nodes (for running multiple on one machine)
john --node=1-2/4 --wordlist=rockyou.txt hashes.txt

# Works with all attack modes
john --node=1/3 --incremental=Alnum hashes.txt
john --node=1/3 --mask='?a?a?a?a?a?a?a?a' hashes.txt

# Combine fork + node for local + distributed
john --node=1/4 --fork=8 --wordlist=rockyou.txt hashes.txt

# John's own format detection (try and see)
john --list=formats | grep -i md5
john --list=formats | grep -i kerberos
john --list=formats | grep -i sha

# External identification tools
hash-identifier '$2y$10$...'
hashid '$1$salt$hash'
name-that-hash -t '$6$salt$hash'

# hashid with john format output
hashid -j '$6$rounds=5000$...'

# Identify from file
name-that-hash -f hashes.txt

# Benchmark a format (measure H/s on your hardware)
john --test --format=bcrypt
john --test=60 --format=sha512crypt   # run for 60 seconds

# Target specific users from a shadow/dump file
john --users=root,admin --wordlist=rockyou.txt unshadowed.txt

# Target by UID range
john --uid-min=1000 --uid-max=1999 unshadowed.txt

# Select only salts appearing N+ times (optimize salt reuse)
john --salts=2 hashes.txt       # only salts with 2+ accounts
john --salts=-5 hashes.txt      # only salts with 5 or fewer accounts

# Use custom config file
john --config=/path/to/john.conf --wordlist=rockyou.txt hashes.txt

# Encoding support (non-ASCII passwords)
john --encoding=utf-8 --wordlist=unicode_words.txt hashes.txt
john --encoding=koi8-r --wordlist=russian.txt hashes.txt

# Filter by minimum/maximum password length candidates
john --min-length=8 --max-length=16 --wordlist=rockyou.txt hashes.txt

# Only crack hashes of specific format in mixed file
john --format=bcrypt --wordlist=rockyou.txt mixed_hashes.txt

# Reject short wordlist candidates during rules
# (add to rule: >7  means reject if len < 8)

# Show pot file contents directly
cat ~/.john/john.pot

# Clear pot file (start fresh)
> ~/.john/john.pot

• John the Ripper Documentation
• john-jumbo GitHub
• Hydra
• KoreLogic Rules
• SecLists Wordlists
• HackTricks

• Cracking Toolkit (Hash ID, crack time, hex converter)
• Hashcat (GPU-accelerated cracking)
• Net-NTLMv1 (NTLMv1 DES cracking)
• NetExec (Hash capture)
• Mimikatz (Credential dumping)
• BloodHound (AD attack paths)
• AD Toolkit (AD cheatsheet hub)