Search everything Ctrl K

John the Ripper

John detects the format by itself and, above all, ships the *2john converters that extract a crackable hash from encrypted files. On HTB it is the usual choice for password-protected zips, encrypted SSH keys and KeePass databases.

Platform
Linux · Windows · macOS
Official site
openwall.com/john/
On HTB
11 machines
Install 
sudo apt install john

John the Ripper cheat sheet

8 commands

More formats

Force the format 
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Look up a format name 
john --list=formats | tr "," "\n" | grep -i krb
.pfx certificate, PDF, Office and GPG 
pfx2john cert.pfx > hash.txt
pdf2john doc.pdf > hash.txt
office2john doc.docx > hash.txt
gpg2john clave.asc > hash.txt

In our cheatsheets

JWT analyser › Attacks

John the Ripper 
john --format=HMAC-SHA256 --wordlist=/usr/share/wordlists/rockyou.txt jwt.txt

Hash identifier › Cracking

Wordlist 
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Show results 
john --show hash.txt
Merge passwd and shadow 
unshadow passwd shadow > hashes.txt
Extract hashes from files 
zip2john backup.zip > hash.txt
ssh2john id_rsa > hash.txt
keepass2john Database.kdbx > hash.txt
office2john informe.docx > hash.txt
pdf2john documento.pdf > hash.txt

HTB machines where John the Ripper is used

Taken from the chapters of IppSec videos where John the Ripper shows up. The ▶ link jumps to the minute of that part.

Guides that use John the Ripper