> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# John the Ripper

> John the Ripper cheat sheet: cracking passwords from SSH keys, ZIP, Office, KeePass, shadow, and more.

## Basic Syntax

```bash theme={"dark"}
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### Common Options

| Option           | Description                           |
| ---------------- | ------------------------------------- |
| `--wordlist=`    | Wordlist file                         |
| `--rules`        | Apply default rules                   |
| `--format=`      | Force hash format                     |
| `--show`         | Show cracked passwords                |
| `--list=formats` | List supported formats                |
| `--single`       | Single crack mode (username mangling) |
| `--incremental`  | Brute-force all combos                |

***

## Identify Hash Format

```bash theme={"dark"}
john --list=formats | grep -i ntlm
john --list=formats | grep -i sha
```

Or auto-detect:

```bash theme={"dark"}
john hash.txt
```

***

## Extract Hashes (\*2john Tools)

John includes tools to extract hashes from various file types.

### SSH Private Key

```bash theme={"dark"}
ssh2john id_rsa > hash.txt
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### ZIP File

```bash theme={"dark"}
zip2john protected.zip > hash.txt
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### RAR File

```bash theme={"dark"}
rar2john protected.rar > hash.txt
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### 7-Zip

```bash theme={"dark"}
7z2john protected.7z > hash.txt
```

### PDF

```bash theme={"dark"}
pdf2john protected.pdf > hash.txt
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### Office Documents (Word, Excel, PowerPoint)

```bash theme={"dark"}
office2john protected.docx > hash.txt
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### KeePass Database

```bash theme={"dark"}
keepass2john Database.kdbx > hash.txt
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### PFX / PKCS#12

```bash theme={"dark"}
pfx2john certificate.pfx > hash.txt
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### Kerberos TGS (Kerberoast)

```bash theme={"dark"}
kirbi2john ticket.kirbi > hash.txt
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### BitLocker

```bash theme={"dark"}
bitlocker2john -i disk.img > hash.txt
```

### GPG Key

```bash theme={"dark"}
gpg2john private.key > hash.txt
```

### Mozilla Firefox

John's `mozilla2john` only parses the legacy `key3.db`. For modern Firefox (`key4.db` / `logins.json`) use a tool like `firepwd`.

```bash theme={"dark"}
mozilla2john key3.db > hash.txt
```

***

## Common Cracking Workflows

### Linux /etc/shadow

```bash theme={"dark"}
unshadow /etc/passwd /etc/shadow > unshadowed.txt
john unshadowed.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### Windows NTLM

```bash theme={"dark"}
john --format=NT hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### MD5

```bash theme={"dark"}
john --format=raw-md5 hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### SHA256

```bash theme={"dark"}
john --format=raw-sha256 hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### bcrypt

```bash theme={"dark"}
john --format=bcrypt hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

***

## Rules

```bash theme={"dark"}
# Default rules
john hash.txt --wordlist=rockyou.txt --rules

# Specific ruleset
john hash.txt --wordlist=rockyou.txt --rules=KoreLogic

# List rule sets
john --list=rules
```

***

## Show Results

```bash theme={"dark"}
john --show hash.txt
john --show --format=NT hash.txt
```

### Potfile

```bash theme={"dark"}
# Location
~/.john/john.pot

# View
cat ~/.john/john.pot
```

***

## Quick Reference — \*2john Tools

| Tool             | Source                               |
| ---------------- | ------------------------------------ |
| `ssh2john`       | SSH private keys                     |
| `zip2john`       | ZIP archives                         |
| `rar2john`       | RAR archives                         |
| `7z2john`        | 7-Zip archives                       |
| `pdf2john`       | PDF files                            |
| `office2john`    | MS Office docs                       |
| `keepass2john`   | KeePass databases                    |
| `pfx2john`       | PFX certificates                     |
| `kirbi2john`     | Kerberos tickets                     |
| `bitlocker2john` | BitLocker volumes                    |
| `gpg2john`       | GPG keys                             |
| `mozilla2john`   | Firefox legacy key3.db (not key4.db) |

***

## John vs Hashcat

| Feature            | John     | Hashcat      |
| ------------------ | -------- | ------------ |
| GPU support        | Limited  | Excellent    |
| \*2john extractors | Built-in | Not included |
| Exotic formats     | Better   | Fewer        |
| Speed (GPU)        | Slower   | Faster       |
| Default rules      | Better   | Manual       |

Use John for **extracting hashes** and **exotic formats**. Use Hashcat for **GPU-accelerated cracking**.