🛠️ John the Ripper

Installation

sudo apt install john

Usage

Offline password/passphrase cracker. Two distinct jobs, always in this order:

1. Extract — turn a proprietary file’s embedded password-verification data into John’s generic hash syntax, using whichever *2john script matches the format.
2. Crack — run John’s normal wordlist/incremental attack against that extracted hash.

See Offline Cracking of Password-Protected Files (-2john) for why this two-step pattern works the same way across every format below.

Common Commands

Extraction (*2john family) — format → hash

Command	Format
zip2john '<file>.zip' > zip.hash	Password-protected ZIP archive.
pfx2john '<file>.pfx' > pfx.hash	PKCS#12 (.pfx) certificate bundle.
ansible2john '<vault_file>' > vault.hash	Ansible Vault-encrypted file or !vault | block.
pwsafe2john '<file>.psafe3' > psafe.hash	Password Safe v3 database — see Password Safe (pwsafe).
ssh2john '<id_rsa>' > ssh.hash	Password-protected SSH private key.
office2john '<file>.docx' > office.hash	Password-protected Office document.

These are just the formats seen so far across write-ups in this vault — the full list (rar2john, keepass2john, bitlocker2john, and dozens more) is on John’s wiki. Every script follows the identical <format>2john <input> > <output>.hash shape.

Cracking

Command	Description
john '<hashfile>' --wordlist=/usr/share/wordlists/rockyou.txt	Dictionary attack against an extracted hash.
john --format='<format>' '<hashfile>' --wordlist=/usr/share/wordlists/rockyou.txt	Same, forcing a specific format when John can’t auto-detect it from the hash (e.g. --format=pwsafe).
john '<hashfile>'	Auto-detect the hash format and run John’s default cracking modes (single-crack, then wordlist, then incremental) with no wordlist specified.
john --show '<hashfile>'	Reveal an already-cracked password without re-running the attack.

Tips & Tricks

• Every password John successfully cracks gets cached in ~/.john/john.pot — --show reads straight from that file, so a hash cracked once during recon never needs to be re-run, even in a completely separate terminal session or after a reboot.
• Unlike Hashcat, John usually doesn’t need a mode flag specified — the hash’s own header (written by whichever *2john script produced it) already tells John what it’s looking at. --format is only needed when that auto-detection is ambiguous.
• Several *2john output formats (Ansible Vault being the common one in this vault) are also directly consumable by Hashcat with the right -m mode — worth switching crackers if John’s built-in speed for a given format is slow.
• Every *2john script is callable by its bare name once john is installed — most are symlinks into /usr/share/john/ under the hood, but that’s an implementation detail, not something that needs typing out; which <format>2john confirms one exists before assuming a format isn’t covered.

Related Usage

File	Created
HTB - Administrator	Wednesday, July 22nd 2026, 5:00:00 am
HTB - Timelapse	Friday, July 24th 2026, 12:47:06 am

---

References: John the Ripper GitHub